In the context of GDPR? I was left guessing what a regulator in Brussels might consider reasonable when their path to career advancement might run through my employer. Coupled with being uncertain what various national regulators (or empowered industry bodies) might add in, as they were allowed to do so until quite literally the last second. It left a person with no good way of judging what might be considered reasonable, only nervous paranoia.

It was a distinctly unpleasant experience and one I was left thinking was both anticipated and avoidable.

The problem is, not all personal data corresponds to the intuitive notion of "private informations". For instance, I, as a U.S. citizen, would be violating the GDPR if I operated a dumb HTTP server that stores request logs indefinitely and does no other processing, such as "python3 -m http.server". (IP addresses are personal data, and U.S. authorities can make me turn over my logs; thus, I cannot store the logs for however long I want.)

Even when you have clear legal obligations to collect a bunch of private data, you still have to figure what reasonable measures to protect it are. What's a reasonable measure when you're obligated to keep seven years of financial records about your customers in a way that lets you produce ready reports for regulators? Complete with mandatory personal identifiers for tax purposes?