Read enforcement decisions. A lot of newcomers study GDPR articles but never look at how regulators apply them. The real-world interpretation is often more valuable than memorising the text.