I actually think it's in most cases not that bad for new projects, since you can from the beginning design it accordingly. Tracking down all the details, making sure existing vendors are compliant (and having to swap out those that don't) and finding replacements for processes you maybe wouldn't do like that now in an existing application sounds harder than minimizing exposure in the first place. keyword "privacy-first design"