Exactly. Even if you win, you won't win anything of much value -- most (if not all) of the money will likely go to your lawyer. And you have a lot to lose, mostly wasted nerves and time you could have spent improving your business -- or simply living your life stress-free.

Defending even from bogus lawsuits is a huge expense of human energy for the non-experts (I'd wager that's 99% of the world's population).

We're a medium-sized software company, and we had to create a dedicated GDPR position so someone can look into everything and decide whether we're GDPR-compliant, and if not, how we can fix it. GDPR really complicates everything, even though most uf us (devs) are actually in favor of it (because we don't really like the idea of companies tracking us forever).

article 12 accounts for this, the DPA can refuse to act or fine a reporter if the request is unfounded or abusive.

Maybe as a countermeasure for abuse it's too small, but it's not a totally absent concern.

Sue you for what? What "suing ammunition" exactly does the GDPR provide your competitors with?

The authorities are not idiots, and have limited resources - they are only going to be chasing the true bad apples that are willfully infringing the GDPR.

Suing you directly will not fly in the EU (maybe in the UK, but that is only going to be an issue for 1 year or so).

I suspect the DPA will start with a letter, where you will need to explain your current practices.

Then, nothing more happens (if you are mostly-complind and good-willed). Maybe you will get some written instructions to better yourself.