We where already subject to much stricter rules, so we honestly didn't have to do anything. We have started selling GDPR consulting, so it's only positive.

Both my colleagues and I have much stricter personal guidelines to data protecting than required by our employer, our chief security office and the GDPR, so it's not really an issue.