If that were true we wouldn't be seeing daily threads here (like this one) that effectively amount to "I don't want to follow the law/protect the data I collect" for months now.
Complying with GDPR can involve a significant cost, but as said multiple times already, the issue isn't data privacy and security but the vast ambiguity of the law. Costs and risk explode when the rules are vague and applied "on-principle".
There are numerous comments on this page that keep saying you need "a good reason" without realizing that is absolutely useless in a legal sense and can open up a large volley of litigation against any business.
You're not opening yourself up to litigation from random 3rd parties -- they can only file complaints to regulators who will decide how to respond.
Forgive me if it doesn’t make me comfortable that the decision whether to file a lawsuit against me or not is left to some often uneducated and inexperienced regulators.