The purpose of this thesis is to investigate the compliance of GDPR practices in Norwegian organizations. Two dimensions are used to assess compliance: Implementation and internalization. We utilize a cross-sectional ...