Companies have some mistaken notions about how to comply with the new data protection and privacy regulation – and that could cost them.