I did quite a bit of work implementing GDPR compliance not long before it became enforceable and it was quite easy? Basically we had to make sure we knew where

I did quite a bit of work implementing GDPR compliance not long before it became enforceable and it was quite easy? Basically we had to make sure we knew where data was kept and how to delete/retrieve it. The biggest piece of work was making sure our logs didn't have personal info in them (sensible anyway imo) and adding proper log rotation. Like every company will be different, but you really should know where your data is kept.