I know it's not black and white at all. But it feels to me that if I'm processing personal data about my users, then it's reasonable for them to ask what it is

I know it's not black and white at all. But it feels to me that if I'm processing personal data about my users, then it's reasonable for them to ask what it is and where it is. There are overheads that come with doing business. GDPR is going to shake out some of the companies that are competent at using personal data but incompetent at telling people what it is and where it's stored.