It seems incredibly excessive to me unless your business model is harvesting personal data. I work at a rather larger SME (multi channel retailer/wholesaler) an

It seems incredibly excessive to me unless your business model is harvesting personal data. I work at a rather larger SME (multi channel retailer/wholesaler) and we are spending almost nothing. But then we were not doing anything creepy with our customer data before. We are updating some documentation and will ditch some old data we don't need any more, reword the privacy policy on our website etc. I am not apportioning any direct cost to GDPR as these are all things that need attention periodically anyway.