That my be true - but I work with a lot of companies and they way the legal departments are hunting down problems has changed dramatically.
I have customers that are asking "Do we really need this kind of data".
I have customers that are asking "Do we really need this kind of data".
GDPR and California et al. turned data privacy from a technical-moral issue into a legal one.
And healthy companies have a robust, empowered legal department to keep them on the right side of the law.
When Technical Architect says "We shouldn't do this," few listen. When General Counsel says "We can't do this," things change.
“Did we do a PIA?”
“Is this a data leak and should we contact their privacy officer?”
These are common questions now. GDPR changed a lot of things. The basic idea that you'd just send and receive any data you have that seems useful from a technical standpoint to third parties and see what you would actually end up using is gone. Step one is as you say: “do we really need this kind of data?”