The future-defining fines that initially made the headlines have yet to materialise, but experts say the GDPR’s true potential just has not been recognised yet.