I am really happy that EU forces you to properly track what and where you store data about users. Sloppily just storing data everywhere and not properly deleting it is a huge security/privacy hazard, making such reckless behaviour illegal is a great thing.

>For larger companies i can tell you that the red tape and additional overhead from GDPR is horribly expensive to implement.

My company had about a week of design of our data handling infographic and policy page and that was it for GDPR. The transition was incredibly simple, as we just didn't keep such data in the first place.

Because we did collect voluntarily submitted items from users which might contain such protected data, we simply explained our retention process to users and documented in full the data's life-cycle once it hit our servers. I think we had to add a few extra S3 regions for uploads also, but that was just a few clicks.

GDPR is anything but a headache unless you're trying to do the things the GDPR doesn't want you to be doing; then yeah, it's probably quite a headache.

>Not to mention the reduced happiness from working with GDPR.

I'm of the opinion it should be even more onerous to deal with people's data than it currently is. GPDR doesn't go far enough.