I operate a B2B SaaS. We sell a service to other SaaS companies. To deliver our service, we are sent PII from our customers which we process as a subprocessor u

I operate a B2B SaaS. We sell a service to other SaaS companies. To deliver our service, we are sent PII from our customers which we process as a subprocessor under GDPR. From the perspective of selling a B2B SaaS service, GDPR has been incredibly successful at making Security & Compliance an important discussion that is had during the sales process. Most leads will have security/compliance as an agenda item during sales calls, while before GDPR this was much less common. GDPR has effectively turned Security & Compliance into a selling point and a point of competitor differentiation (it was this way in the past too, but much more so after GDPR). I think in the long run, this has/will result in companies having a heightened awareness of security/privacy and budgeting more time and money on security, simply because GDPR has connected it more directly to the business's bottom line. I think it's good in the long run. In practice, the result is probably a decrease in risk of data breaches (less companies have your data, and the ones that do are more aware of their responsibility to treat it properly). It's important to note that this benefits everyone (not just people of the EU). Very few companies will go through the trouble of treating EU data differently than non-EU data. Everyone is benefitting.