GDPR is the Sarbanes-Oxley of data privacy. It was intended to stop the large abusers but it just stifled small companies, giving large companies even more of a protective advantage. Omar size fits all rules make no sense.
It also hasn't gone in to effect yet, so I'm not sure how much stifling it has done so far.