The real question is whether something has to go wrong before action is taken. Driving at 80 km/h through a residential area does not necessarily result in someone being killed. But it significantly increases the risk to others – and the likelihood of an accident is clearly much higher than when driving at 30 km/h.
The same principle applies to data protection. As a business owner, I am legally required to comply with applicable data protection requirements and implement the prescribed measures, just as drivers are required to comply with road traffic regulations.
