Nobody just doing ordinary business things is going to get caught up in the GDPR. The EU are going to go after the local companies first and/or the worst offenders. Just sit back and wait for the case law and best practices to settle down and then decide what to do.

My feeling is it is going to end up like the cookie law, but who knows at this stage.