The EU’s General Data Protection regulation (GDPR) has been hailed by privacy advocates, but there remains concern among cybersecurity experts that the regulation doesn’t go far enough in securing data.

According to a survey by software company Avecto, 47 percent of international cybersecurity professionals believe the regulation’s cybersecurity mandates were not strong enough to ensure adequate security. The survey took responses from 500 IT and cybersecurity professionals across the U.S., Germany and the U.K.