Personally I do wish they would intervene more, but if you consider how broad GDPR/DPA18 is I honestly don't think they can enforce it in the way a normal person would expect. Either it's a legislative issue (i.e., legislate better) or we accept these attempts at "balance". It's usually not the institutions weakness it's the legislation or the framework in which they exist.

Consider one example - you "process" (collecting, using, storing, viewing - literally anything) personal data in an electronic system without the latest security patch. Are you breaking GDPR/DPA18? Easily done, especially for sensitive data. "...taking into account the state of the art, the costs of implementation, ... the risk of varying likelihood and severity for the rights .. of natural persons ... the processor shall implement appropaite technical ... measures to ensure a level of security approapite to the risk" (DPA18 Art 32).

I imagine a large number of companies flout the above without realising. Especially when processing any information regarding health, criminal offense data, race, religion, philosophical beliefs etc, which is "special category data" and requires strong protections.

DPA18 Article 32 "Security of processing" - https://www.legislation.gov.uk/eur/2016/679/article/32