So . . . what we have here is a law that assumes that if you are a good enough engineer to create software that makes money, you are a good enough engineer to c

So . . . what we have here is a law that assumes that if you are a good enough engineer to create software that makes money, you are a good enough engineer to comply with the law, given two years' notice. I don't have a problem with that. If the law has a side-effect of people who suck at understanding and organizing and managing data responsibly not starting companies and making money off of data, I'm also okay with that. Maybe the days of two guys starting a company in a garage learning how to handle other people's information before they start a company dependent on it is just beginning. I'm also okay with that. You don't have a right to be incompetent. You don't have a right to be clueless when it comes to databases and information. You especially don't have a right to take advantage of other people who don't understand exactly what it means when they agree to a ToS page. The reason there are so many comments to the effect that this is a non-issue is that it's just not hard to comply unless the business you're running is doing something shady. There is nothing technically difficult about complying with GDPR. If it's hard for you and everyone in your company, I don't know what to say. Hire someone who doesn't suck at this. This is only difficult from a business point of view. Not a technical one.