GDPR, like its predecessors for many years, has a substantial compliance requirement which of course costs businesses money. It also however creates a level playing field, most well-run honest businesses would want to comply with these rules (e.g. customer phones up, you have their address wrong, you fix it) but GDPR makes it an obligation for the shady outfit they're competing with too.