That would probably be it. It's a nightmare complying with GDPR if you're a small company and it becomes even more of a problem when people could use it as a weapon by making thousands of requests for their data. If you have a lot of users you really need to have everything automated otherwise just complying with the law becomes prohibitively expensive.