Technical person here! I was tech lead at an energy company in the Netherlands. We had a compliance dept (mostly 1 person) I worked closely with before GDPR was on the radar as the energy sector here is fairly well regulated.

It’s true that compliance can sometimes be scary and requirements are not always clear. Big company ending fines probably keep some people awake at night.

The point is regulators don’t generally want to end your company, they want to see (proof of) reasonable efforts towards full compliance.

Compliance does take time and effort and can be technically challenging. It can be a constant overhead on regular technical / development efforts. But it also isn’t rocket science. It would help people to not overreact (also, there has been lots of time to prepare for it).