On one hand... - As someone else mentioned, GDPR are actually easier to implement from a technical perspective in a project from the ground level than it is a

On one hand... - As someone else mentioned, GDPR are actually easier to implement from a technical perspective in a project from the ground level than it is a legacy project that already has tons of data. - If you know from the beginning something is not a viable business model than it is easier to shift your business model early on in the company than post-revenue after you already have your business built on personal data. On the other hand... - The rules are very complex and sometimes ambiguous leading companies to sometimes legitimately be unsure if they are doing the right thing. And paying a lawyer to tell them is outside the budget of small business. - A mid-sized product has the worst burden because they need to convert legacy data AND don't have the resources. - To properly implement often requires a at least intermediate knowledge of devops / encryption / etc which might mean no more MBA bootstrapping v1 after spending two weeks learning mySQL or a coding bootcamp without hiring an experienced Software Engineer. Personally as a small company I don't mind it. But I'm also a coder. If I had to outsource my code to someone who was being paid hourly and you told me GPDR would add hundreds of hours (not unrealistic) it would be a big portion of my budget with no business benefit (though personally I think a lot of benefit for the customer).