agree with this. If done well, then this has all sorts of secondary benefits. better engineered systems, more agility through implicit fire breaks, stronger devops processes, faster backups etc.

I don't think GDPR should have been enforced on existing systems as in many cases it became a tick box exercise. Best practice and certification for new development would have made more sense.