This has been a constant headache, not the rules or how to apply it, but our customers still act like there isn't such a thing like GDPR, and actively demand, DEMAND that we put in place functionality that is in clear violation of GDPR, and when you try to inform and explain to them who things work they get mad at me and threaten that they will get a more professional shop to do things for them shrugs
I'm not going to lie, if one of them switches shop and they make what they asked us, I'm going to report, in Finland law isn't selective even if it isn't enforced.