I'm interested to know what parts are costly? I found it relatively easy to implement processes for 'right to be forgotten' and 'emergency breach notification'

I'm interested to know what parts are costly? I found it relatively easy to implement processes for 'right to be forgotten' and 'emergency breach notification' as well as the default opt-out of personal data and marketing. Not trivial, but not particularly expensive. The rest is exactly as you say, infosec best practice that my industry required in any case. The only expensive part I could see is right to be forgotten, that is if you expect to get a lot of requests for your particular application's use case.