If Europe’s data regulators hoped that the transition to its new rules would be smooth and simple, they are in for a shock.

Six months on from when the European Union’s General Data Protection Regulation (GDPR) came into force, organisations still say that there is a lack of clarity about what they can—and cannot—do with personal data, or in what circumstances they might be flouting the law.

Neil Hodge is a freelance business journalist and photographer based in Nottingham, United Kingdom. He writes on insurance and risk management, corporate governance, internal audit, compliance, and legal...