While this approach is reasonable and practical for credit card data, I doubt it's possible (let alone practical) for most businesses to do the same with what t

While this approach is reasonable and practical for credit card data, I doubt it's possible (let alone practical) for most businesses to do the same with what the GDPR considers personal data. You'd have to avoid email addresses, names, postal addresses, phone numbers, ... - even in fields where such data is not even supposed to be, like comments or emails. Might be possible if one just sells ebooks or similar digital goods without much customer interaction. But for anything more complex than that, you're pretty much out of luck.