"Compliance is hard" when it comes to the GDPR is patently false. Don't gather data you don't need, and don't track things you don't need, don't share personally identifying data, and don't retain data you no longer need.

All those things are the default. It is hard to run into a situation where you risk violating the GDPR without actively making a decision to do so, with maybe the exception of the whole "users have a right to all their information/delete all their information" thing, which should be a straight-forward database operation unless you're doing something asinine.

So you get no user accounts, then.

The minute you have user accounts, you have to export everything associated with EU residents that invoke data export rights. Every table with a user foreign key.

This is a big scope.

Every upvote. Every comment. Every file upload. Even on your innocuous personal blog.

Any product imaginable quickly becomes a big GDPR data export problem.

If running an SQL query is too large a burden for you to bear, then you'd have already crumpled at the first bug in your codebase.

Where did anyone say that "running a SQL query is too large a burden?"

If you're a small company, then you probably only have one database with a few tables in it. If that's the case, it really shouldn't be a huge burden to be able to run a few queries to export that data. And if it is, then you probably have other scaling problems that are an existential threat to your business.

As an example: assuming a standard RDBMS setup with a primary and replicas, I would expect that bulk operations would be done on particular replicas dedicated for that purpose. That way you aren't interfering with writes, or with the "normal" reads that come with regular website use.

I think it's a lot easier to comply with the GDPR now if you're just starting out as a brand-new company. The difficult bit was if you were an existing, smallish company with (in some ways understandably) lax data collection/tracking policies, and suddenly needed to spend a multiple of your revenue to clean all that up in order to comply with this new law that was coming onto the scene. Big companies also had a lot of trouble getting their systems in order, but often had a lot more resources available to do so.

If you are starting out now, and you want to avoid trouble, you just avoid collecting data about site visitors. And when you do need to collect data (perhaps you need customer accounts), then you spend some time thinking about what it means to furnish that data on request, or to delete that data. No, it's not zero work. But it's a hell of a lot easier to build these sorts of controls into a system from the start, than it is to build it in later. I don't really work with web/full-stack frameworks, but I would be surprised if there aren't built-in or third-party modules for the popular ones to help with this process.