The way I understand it, the purpose of GDPR (General Data Protection Regulation, EU law) is to make sure that personal data is treated transparently and securely. So half of it is about giving the users more control over their personal data, and the other half seems to be related to INFOSEC and its best practices. It seems you have to comply with a list of "best practices" and document everything you do to be able to demonstrate that you are indeed protecting the user's data, although those "best practices" are just very vague guidelines or comments based on possible interpretations of the law (at least for now).
But if that is the way it is, then will the all-too-common sloppy practices in security suddenly become illegal? For example, I don't think there is now a law that makes it mandatory to keep your website updated (think of CMS's like Wordpress or Drupal, or frameworks like Laravel, etc), but with GDPR if you have a Wordpress blog with subscribers then names, hashed passwords, emails, and maybe other personal data will end up in your database and you will have to take the necessary steps to protect that data. This means that if you don't keep your Wordpress up to date, you are breaking GDPR. And the same would appear to be true of a lot of other very common bad practices. Not having HTTPS is not considered illegal now as far as I know (unless you need to process credit-card data directly on your website, maybe). But with GDPR, it might become illegal in lots of other cases, like for simple websites that have contact forms where the user submits personal data. Or think of the bad practice of sending passwords in plain text via email, I see this all the time. And what if you download a backup copy of your website or your emails or your documents (all containing personal info about your clients for example), and you store the backup in a simple unencrypted USB key, or in an external drive that you keep in a drawer without a lock. All this is commonplace, and I personally see it everywhere from freelances to small companies, and while these bad practices might now be used to sue someone in case of trouble and show they are responsible, if nothing happens or if nobody sues you anyway, then who cares, it's ok. But with GDPR, all this will have to be documented explicitly, and there must be someone responsible for assessing all these situations and make sure everything is compliant all the time. So doesn't this mean that bad security practices are going to become illegal, no matter if those bad practices ever lead to data leaks or any problems?