> This must not be an expectation for any regulation that applies to business in general Why not? We have that for a bunch of professions already, and for good

> This must not be an expectation for any regulation that applies to business in general Why not? We have that for a bunch of professions already, and for good reasons. You can't just claim to be a doctor, run a hospital or work as a electrician, you need to prove you're able to, before you can do certain things. Engineers should already be data-aware by default, regardless of what regulations, since we do have the expertise to understand it. Then I guess the expectation was initially kind of that businesses would self-regulate, but seemingly not, so here comes the end of the cowboy developer days, if you want to build large companies that handle people's personal data at least. > You cannot realistically expect that I have any experience with GDPR or fully understand its requirements If you build websites where the idea is that you store people's personal data, then yes you should understand what that means and how that works. Like if someone called a plumber for a pressure problem, and the plumber says "How am I expected to understand how that works in your specific house?!", of course I expect the plumber to know their shit around their profession. If you don't understand the technology nor what rules you have to follow, then don't go into that profession. > Non-compliant businesses are not those who are malicious or ignorant, they can make mistakes because legislators did not help them. In my experience, the companies who had a hard time becoming compliant with GDPR were companies that either made their revenue by selling user data, and now had to make a lot of changes, or companies that were careless with data in the first place, not thinking twice about where to store things or who has access to what. I'd be happy to see any sort of counter example of a company that A) doesn't make their revenue based on selling personal data, B) have a thoughtful architecture/design for data in the first place, together with C) had a difficult time becoming compliant with GDPR.