Your statement makes it sound like the GDPR applies to individuals doing everyday activities (or draws an equivalence). Just for clarity, I looked it up and it

Your statement makes it sound like the GDPR applies to individuals doing everyday activities (or draws an equivalence). Just for clarity, I looked it up and it doesn’t appear to: “This Regulation does not apply to the processing of personal data: (...) by a natural person in the course of a purely personal or household activity;" So, it really only applies to companies, or if you’re processing a large amount of user data for a hobby project. That being the case, it doesn’t feel like the bar to being able to respect the law is so very high. But I’d be interested in counter examples.