We've gone through a couple of audits from customers' GDPR-compliancy consultants.

As a result we have have been triggerered to perform some well-over-due security reviews, thinking about security processes and data compartmentalization, documenting some procedures etc. I think it's by far a net-good, even as relatively small company.