Working for an e-commerce company in Europe. We didn't have much trouble. Someone was assigned last year from our security team to teach and consult other team

Working for an e-commerce company in Europe. We didn't have much trouble. Someone was assigned last year from our security team to teach and consult other teams within the company to keep their products compliance. Even before going for GDPR everything about user data was very strict so don't remember if we (at least my team) did anything new. We always had data anonymization pretty much everywhere, no production access even to our deployment team, no third party company is allowed to store information or even cookies from our users, a clear and short page for our users to tell them which companies have access to some of their data (ex. delivery company). We always have been obligated to report a data breach to the government and users if it happens. It is a very long list, and goes down to stuff like even HR recruiter is not allowed to keep applicant information after X amount of time. All of that also means sometimes we are unable to do something fancy with users data to improve our products. Or use some third party services because the third party company doesn't look reliable or they want to access user data.