This. GDPR is not merely a list of bad things not to do, compliance requires a lot of new work and risking huge penalties if someone decides your lawyer should

This. GDPR is not merely a list of bad things not to do, compliance requires a lot of new work and risking huge penalties if someone decides your lawyer should have interpreted the (untested!) law differently.