"Nothing about this is hard"....at the architecture level.

My own experience of running up against GDPR is not actually about running up against GDPR, but about running up against,
(a) risk-averse managers who don't actually understand the law but tell me I can't do things to be on the safe side, and
(b) people who use it as an excuse for saying "no", in the same way as people use H&S.