If you think you can understand the GDPR by reading it, that's merely proof you haven't read it.

Questions without answers in the GDPR:

* how to carry out a legitimate interest balancing test

* who is your lead regulator (do you have a lead regulator?)

* When do you need a DPO (large scale is left undefined, as is systematic)

* How reasonable will any particular regulator be towards inadvertent violations

* what precisely counts as the required technical and organizational measures in art24

* how do you define what is one purpose and what is two purposes?