I did GDPR/CCPA consulting for a few retailers. If you have a good handle on the data you're storing (good data governance), compliance tends to be pretty easy.

I did GDPR/CCPA consulting for a few retailers. If you have a good handle on the data you're storing (good data governance), compliance tends to be pretty easy. Even if you're being fast&loose with some of your customer data, the fix is usually to quit storing that data. We saw very few customers asking for their data to be deleted (they WANT to be your customer) so delete requests were a very part-time endeavor. If you don't have a good idea of the data you're storing (sadly, very common), or if you're abusing your customers, then it can take years of consultant-hours to unwind the idiocy. But that's not really the GDPR's fault. You would have needed to do this anyway. You'd be amazed at the kind of sensitive cruft that can pile up in SAP if you're not paying attention. It's good to give your systems a good scrubbing once in a while.