The GDPR created an industry around data protection, and a lure to some of perceived easy money. Anyone can “do data protection”! Anyone can say that they are a “data protection consultant” or a “privacy professional”, and even the expensive certs mean relatively little in terms of actual competence, IME. There are loads of talented, amazing data protection people, and I love working with them. The bandwagon is, however, rather long… *grumbles*