I work for an international education startup and while it was obnoxious to get the technical groundwork and auditing done: it doesn't affect the business very much. This shouldn't be too surprising; the GDPR is really only problematic to businesses who's primary purpose was identity and interest brokering. Most folks with actual products to sell aren't in such a bad spot.

Certainly, some folks have opted into some heroics getting all our microservices and datastores audited. But it's good to do that periodically anyways, so we made the audit a multi-purpose affair.