Or every independent software developer who isn’t doing anything nefarious with your data but doesn’t have the resources to implement a bunch of new, EU mandated features.

How hard is it to just not collect data that isn't directly related to the running of your business?

Do you find yourself accidentally including data sales SDK's? Do you finish your website or app and realise you've accidentally set it up to fingerprint the user, scrape everything you can from them and sell it?

If your business is just a tool supported by wanton data scraping are you actually doing anything innovative and worthwhile or are you just making an MVP to pack full of advertising and jump on that bandwagon?

If you aren't doing that, then it's just a matter of checking what data you are harvesting and thinking about why you have it and if you really need it. Because if it's actually critical to the running of your business then GDPR does allow you to keep it. If it's not, why waste space, effort and now risk in bothering to harvest and keep it in the first place.

Let me play devil's advocate, and say that some personal data may not be immediately useful, but if continued to get collected, may become useful (for commercial exploitation) later.

For example, an online shop might collect customer addresses, even if the sale is purely digital. If the shop ever decides to expand to physical goods, those addresses will be very useful to find an optimal location.

However, GDPR prevent the shop from collecting (or more accurately, raises the cost of doing so), since the use, and value of, said data only becomes apparent in the future. So the shop makes the best choice now to remove the collection, and then suffer the future disadvantage.

Save the data, tell them about it in your privacy policy (i.e. that you remember that data and how you have in mind to use it), and add a "delete account" button that deletes that data.

Maybe show a notice just below the address input fields that "we remember your address for a while, this is why" and link to the relevant section in the privacy policy.

Your attitude towards my privacy makes me happy you won't be marketing your products in Europe.

Proper encryption, limited data collection and exposure, and deletion are not fancy features. If this is onerous, it is hard to imagine you are shipping much.

This features you need to implement are the bare minimum required for good security practices.

I'm more likely to hand over sensitive (or even obvious data) if I'm confident it's being handled responsibly. So it could be an opportunity for the markets for your products to increase.