Most of the costs of this (so far -- we'll see how it goes with subject rights; I spent several hours already working on a right to erasure request that was so confusing it will take a number of additional hours just to entangle and document) are learning the regulation (not privacy, but the regulation itself -- very different), doing documentation (the largest cost by far), and holding customers' hands. The last 5% wasn't all that meaningful; a few assorted things, like one of our S3 buckets that was storing encrypted backups of non-sensitive data with no expiration, and it got noticed during GDPR prep. It would have been noticed anyway (probably even before now).
We've also lost customers (including a contract that would have been our second-biggest) because our competitor is either lying or doesn't know anything about the GDPR, and has convinced customers they're compliant. Their story sounds easier than ours; "We're in the EU, so we're compliant" as opposed to "Hey, you need to sign this DPA with us to be compliant."
And no, many companies already did care about privacy. Companies are not faceless villains -- they're made up of people like you, assuming you have a job, and even aside from not wanting the bad publicity of breach or misuse most people want to use data correctly.
