The thing with GDPR is that it mostly affects legitimate, ethical businesses without their own legal department, i.e., those that won't engage in activities GDP

The thing with GDPR is that it mostly affects legitimate, ethical businesses without their own legal department, i.e., those that won't engage in activities GDPR is supposed to protect against anyway. Fly-by-night companies often simply don't care.