A company should categorize its GDPR personal data to ensure it is handled correctly to comply with the regulations. Mixing personal data with information under a less stringent privacy policy risks exposing it and violating GDPR standards. This can be very expensive for the violating organization.