Part of the reason for the GDPR scramble is that it deferred specifics to each country's data regulator, and some of that guidance was still being issued shortly before the deadline.