Most businesses only get one of those questions answered.
The software works, and nobody can say where the customer data goes. Or the policy is perfect, and nobody has ever looked at the system behind it.
If you’ve ever been told something is “GDPR compliant” and had no way to check, you’ve stood in that gap.