It's not 2 years though. European countries have had variations of the law for decades. If you ever bothered to comply with those, you'd have had literally decades and very little cost to comply with GDPR.

You didn't (as hundreds of others), so now the EU forces you to. So now you have an opportunity to become a better company: https://medium.com/tsengineering/the-gdpr-blog-post-9a571b13...