GDPR is mostly only excessively onerous when the business model involves gathering and processing information of people who haven't actually consented to what y

GDPR is mostly only excessively onerous when the business model involves gathering and processing information of people who haven't actually consented to what you want you do with it, or you don't have secure storage for the information. If a business can only survive by extracting and processing against the wishes of the owner, or by storing it unsafely, maybe that's not actually a desirable business.