Four years after its entry into force, lawyers and businesses say the European Commission’s 2018 milestone privacy legislation, GDPR has failed to deliver on one of its key promises—to harmonize data protection principles and data privacy laws across the bloc’s two-dozen countries.

Under the General Data Protection Regulation, local data protection authorities received broadened powers to police and sanction companies that do not comply with the law, and their enforcement efforts have gradually picked up pace since 2018.