That's of course the rub with any regulation touching internal processes (just as it is with financial regulation, anti-discrimination laws, workers rights to some extend, ...). If you don't make a mistake revealing it, aren't forced into an audit and have no ex-employees holding a grudge, you can get far violating them.

Part of GDPR effect is that if you get caught, you can't talk it away with some blanket claim in your EULA, you need to have a detailed justification, and there is potential for painful fines, so the risk increases.

We cannot say for sure yet, but in general we can expect that these things will never be checked until there is a data breach of some kind; or if evidence is found in another way.

If the details of the breach indicate you were using data for another purpose than what was allowed you will have a problem.