[reqres]

I'm an EU resident with a SaaS business storing EU personal information.

It's forced us to think more carefully how we build systems to pick up, retain and scrub data. So all clients (>1,000) and their clients (likely in the millions) have benefited

They absolutely won't have noticed a difference - by design!

Unbeknownst to downstream users, there are now more rigorous systems in place to manage this information and reduce the surface area where it might be captured

[Y-bar]

I work with e-commerce in the EU and my experience mirrors yours.

Almost all clients took an honest look at data collection and retention policies.

Data was classified and tools built around the GDPR framework to allow customers to be able to fully retrieve, request changes to, or delete their information from servers.

Most clients ended up collecting less data and retaining it for a shorter time.

All in all from my perspective it seems the law did much of what it was designed to do.