GDPR is actually pretty damn decent to deal with. Saying that while the company has legal obligations to retain a lot of personal data - anonymize, encrypt, report (AML being a part, too), forget (incl. personal encryption keys) and what not.

So definitely - not pain.