I agree it is raising a bar for starting a new business but I think this is a good thing in this case. As a victim of identity theft, I say that burden should

I agree it is raising a bar for starting a new business but I think this is a good thing in this case. As a victim of identity theft, I say that burden should be on entrepreneurs to learn and write good code. I have written a lot of bad code myself but back then everyone was writing bad code to get to market as fast as possible. People who wrote good code and followed best practices for their users’ privacy and security were at disadvantage. This regulation evens out the playing field, so now good guys/gals can compete too. Also this is not hard if you were already following the best practices for security and user privacy. Sure there is some new stuff like real deletes instead of soft deletes. I can tell you from my experience that the people who are the most stressed about GDPR are those who are working at the companies where they had very bad dev practices. One of my friend who works at a decent-sized ecommerce shop, had to finally get rid of CC numbers in their logs. That guys had been pushing for better security and dev practices but would get overridden by managers and team leads. I am glad that GDPR is finally forcing higher ups to finally improve their dev and security practices.