The answer to most of these is the same: companies have to show that they are making a reasonable, good faith attempt to comply. If they can show that they have policies, that they have processes to implement the policies, and that their users have read the policies, understand the processes, and are aware of their own responsibilities then there's a strong likelihood that they will not run afoul of the directive.
No comments yet.