Most remain invisible to customers and externals. However, inside just one company, there are dozens of smaller projects that's fixed security and privacy issue

Most remain invisible to customers and externals. However, inside just one company, there are dozens of smaller projects that's fixed security and privacy issues across all the horizontals: front end, ESB, middleware, databases, applications, you name it. Without GDPR the majority of those hidden improvements would've been postponed indefinately. I do regard spammy notifications as regressions though.