I have an article in draft about some of the marketing surrounding the GDPR, with a focus on the “4%-ers” – those who seek to imply that the slightest defect in policy or practice will automatically lead to a fine of 4% of global turnover.
You might like to look at the website of the UK information Commissioner’s Office for a more reasoned approach, in a series of blog posts about GDPR myths.
You might also care to do a word search of the GDPR itself and read the passages with the words “citizen” or “resident” in them. As a general rule of thumb, your marketing should refer to “citizens” as often as the GDPR does. And no more.
eDisclosure Information Project 