GDPR already does more than any existing law in either US or Europe (not sure about other countries). As every law it will be reviewed and can be made stricter. Changes are likely needed anyway as companies try to circumvent the directive with "creative" ways or incentives for users to give up privacy.

But it's a huge step forward compared to the existing situation.