Is it really that hard to implement the policies of the GDPR? The way I see it it is basically breach notification and right to access/delete data, which does n

Is it really that hard to implement the policies of the GDPR? The way I see it it is basically breach notification and right to access/delete data, which does not seem that difficult and probably not a burden for a startup to "not grow as quickly".