The GDPR consists largely of principles instead of concrete rules. It's possible to reasonably believe that you are fully compliant, but then have a court rule against you. Thus, a company might mitigate risks by getting experienced compliance consultants, and by not toeing the line of what is and isn't allowed. But at some point, working to reduce the remaining risk is not worth the effort. This will depend very much on the business. E.g. an adtech business will likely want to tolerate more risk than a bank.
As the interpretation of the GDPR evolves, compliance efforts must adapt. For example, the Schrems II judgement that invalidated the EU–US Privacy Shield shifted our understanding on the legality of international transfers. This judgement was not necessarily surprising for anyone who paid attention, so to some degree it was possible to prepare in advance. But that judgement was the kind of shift in jurisprudence where you can't fix your compliance by filling out one extra form, but rather have to rethink all international transfers of personal data – a blow to US SaaS providers and European SMEs that depend on them.
Some parts of the GDPR are geared to assist with a compliance process. For example, larger data controllers must create a Records of Processing Activities (ROPA) register. This lists all processing activities and their legal basis, which helps spotting potential compliance gaps. Risky processing activities require an Impact Assessment (DPIA) where the controller has to weigh different factors against each other and determine appropriate safeguards. While the GDPR doesn't necessarily say whether something is allowed or not, it frequently provides factors that must be considered in an analysis.
In addition to the GDPR itself, there's a lot of guidance available. Data protection authorities publish guidelines and can also be consulted directly. In fact, that's sometimes explicitly required. In the EDPB, the different authorities coordinate with each other and publish a series of EU-wide guidelines. Sometimes the subject is very specialized, sometimes the guidelines touch on a very general matter such as the concept of “consent”. These guidelines are an effectively–binding interpretation and thus bring welcome clarity to a compliance process.
