As someone who works (contracts) in central and local government - heavily involved with organisations that have to adhere to and actually police DPA and GDPR (soon) feel that I am well placed to offer my experience.
Using a document and records management system users when saving a document, word, excel etc. are prompted for metadata - the default choice is 'none' (choose able) from a multiple choice dropdown box (contracts, legal, PII etc.) - let you guess what most users choose.
In case you are wondering who check out m0rt's post
Biting the hand that feeds IT
