Should vendors be able to pass along costs of GDPR compliance?

>