Based on responses from over 100 CSOs engaged in a wide range of activities, it looks at how well these CSOs understand the EU data protection requirements, whether complying has been challenging, their interactions with supervisory authorities, their implementation efforts, and experiences with GDPR-based complaints. In so doing, the paper provides helpful insights for the European Commission’s overall assessment of the GDPR’s impact.