> Policing this is expensive, which is why it almost only happens under regulatory pressure.

I completely agree. Before GDPR, many companies did not knew who was accessing the data, what was the reason to store it and if there was any value to that data. Now, I have seen an increase in understanding of which data the companies have.

I have worked adapting services to the GDPR. The reality is that it is very cheap to design systems with 100% data accountability. The main problem is to adapt old systems full of technical debt where nobody knows if the data is used or not, or even how up to date it is.