Complying with GDPR shouldn’t be that hard at all for most businesses if they introduce some basic procedures for handling/storing user data and most importantly don’t want to transfer/sell it to third parties