How can GDPR be enforced when the enforcers aren't prepared?