Hacker News Reader

Very large companies already have in-house council or a law firm on retainer.

Indeed. But if you are a large enough target, you will employ specialized external firms that deal with GDPR, or else.