My previous client is a reasonably large Swedish company with a big German presence and they took GDPR (and data protection in general) EXTREMELY seriously. I know because, outside of the training, I sat in on a few audit meetings.