Most organizations are not compliant with GDPR, and I suspect this survey hugely understates the issue since most companies are small, very small, and probably do not even have GDPR on their radar. I know in the nonprofit sector here in the USA it appears that the very largest ones are doing something, but smaller ones, of which there are many, are ignoring it.
https://www.zdnet.com/article/gdpr-c...time-to-panic/