My company is squarely in the SMB camp at 21 employees and single-digit millions in revenue across three business lines.
GDPR compliance has already cost us hundreds of thousands of dollars and will cost us more as we go on. There will be some very minor benefits to our customers, perhaps, but for the same amount of money we could 100%-definitely-for-sure-absolutely give all of our customers things they would, if given the choice, trade those benefits for.
That's the thing; it's like when you buy an appliance. You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one? That law would provide a benefit, because consumers would get the better appliance, right? Okay, sure -- but at what cost? And what value-producing companies (because companies do provide value for customers!) are going to be marginally less efficient and therefore marginally less effective and therefore, on the margin, go out of business because of it?
There are valuable ideas in the GDPR. The execution is pretty crappy, and in the end it I think it likely reduces net consumer autonomy because it gives them less choice in how they relate to companies.