To further that point, this is a quote [0] from the UK's ICO on that:

> It’s an evolutionary process for organisations – 25 May is the date the legislation takes effect but no business stands still. You will be expected to continue to identify and address emerging privacy and security risks in the weeks, months and years beyond May 2018.

> That said, there will be no ‘grace’ period – there has been two years to prepare and we will be regulating from this date.

> But we pride ourselves on being a fair and proportionate regulator and this will continue under the GDPR, as I set out in my first myth busting blog. Those who self-report, who engage with us to resolve issues and who can demonstrate effective accountability arrangements can expect this to be taken into account when we consider any regulatory action.

[0] https://iconewsblog.org.uk/2017/12/22/gdpr-is-not-y2k/

The law doesn’t actually target Europeans, but anyone in Europe. Since it is based on geolocation rather than nationality, not being in Europe might be relevant legally (IANAL).

It's funny that the law entered the global knowledge about 2 weeks ago... Seems like the grace period should have started 2 weeks ago.

Exactly this.