A real effort to protect the information related to users using a website or webservice is not a trivial effort. Extensive re-architecture and forethought is required in order to fully comply, or at least that's the amount I estimate it would require to be fully GDPR-compliant.

Small firms won't be able to take on the cost, which will hurt new businesses.