We're not a SaaS - but we noticed GDPR appearing as a requirement in RFx's Our software does contain customer information, but isn't the focus. As somebody act

We're not a SaaS - but we noticed GDPR appearing as a requirement in RFx's Our software does contain customer information, but isn't the focus. As somebody actually designed it properly, compliance wasn't particularly arduous. Huge sections simply didn't apply, and where it did we could just link each requirements to the relevant details, API, logs etc. As you mention, I think the main benefit is just formalizing something that should already have been designed. Another benefit is that it's driven 'bottom up' - Customer doesn't have to pay every vendor to provide them a new feature for say "scrubbing a customer". All their providers supply "here's how you scrub in my product" and customer just needs to stitch these mechanisms together to give their customers the ability to be scrubbed.