It is probably fair to say much of the enforcement focus regarding the General Data Protection Regulation (GDPR) has been on those regulators that have historically talked tough about preserving privacy—namely, data protection authorities (DPAs) in Germany, Belgium, France, and the United Kingdom.

Neil Hodge is a freelance business journalist and photographer based in Nottingham, United Kingdom. He writes on insurance and risk management, corporate governance, internal audit, compliance, and legal...