The problem with the GDPR isn't that it is too far-reaching. The problem is that it isn't clear what companies have to do to comply with the new regulation.

Large companies will simply pay their lawyers to deal with this. Small companies basically will have to do their best and hope they don't get sued.