What I meant by the 'four years' comment was not that it takes that long to train, but that GDPR has been included in the training for that long. A four year run-up is plenty long enough for even start-ups to get themselves up to speed and design their systems for privacy by design.
> "What were the lawyers doing all that time before then?"
what lawyers? do you realize that compliance, proving compliance, and implementing mandated features are completely separate tasks with cumulative costs? even if you aren't doing anything with the data?
> Any business trading internationally has to have a care over the regulatory environment of the target country. Why is internet trading any different?
bad, stifling, preemptive regulation is bad regulation in any industry. why is internet trading any different?
Don't you think that size of company would have a lawyer somewhere?