One really can. It took me all of a few seconds to shrug of the GDPR when I first heard of it. Then, with all the scare mongering (webserver logs will be illegal!), I spent a few minutes reading up on it. It's all more than reasonable: if you're not doing anything shady, or are being negligent bordering on incompetent, you can just shrug it off and sleep soundly.
The monetary and time cost is minimal, but the mental benefit is pretty damn good.
Frankly this post has prompted me to reevaluate your other legal advice in this thread.
He did this several times before the corporate veil was pierced and they took him for all he had.
The other case was one that is probably best described as mismanagement ('onbehoorlijk bestuur') where the CEO/sole shareholder of a company started using the corporate account as though it was his personal account. When the company was unable to meet payroll taxes the taxman seized his private assets after piercing the veil.