Sure. The intent of the GDPR has not received much criticism, at least not that I've seen. The concerns some of us have always had are more about ambiguity and interpretation, because on the one hand the law as actually written doesn't allow for much leeway in some cases, and yet on the other hand it has huge ambiguities in key areas hiding behind words like "reasonable" or "legitimate".
It's easy to look at extreme positions, such as the example I gave above for illustrative purposes, and say no regulator is ever going to expect all of that. Probably you'd be right. The difficulty is that somewhere between not doing much of anything to comply and the other extreme such as I described, you cross an invisible line from being sufficiently compliant in the regulator's view (or potentially a court's if it really came to that) to not being sufficiently compliant and no-one really knows where that line is.
When you have not just the threat of fines but also potentially very significant costs in adapting your systems and processes, that sort of uncertainty is never good for anyone. That is particularly true in a case like GDPR, because many of those adaptations are more about being seen to comply than about fixing any actual security vulnerability or abuse of privacy or other tangible problem.
The UK has had regulation like this for decades, and as loosely worded. The regulator rarely imposes fines, and then only when forced to because the infringer is refusing to change their processes. Almost always they give some advice, sometimes a warning. This is done in the context of a conversation with the regulator, like "hey, we've received a complaint, have you got any reason why this happened?" instead of "we received a complaint, you're fined $1000 for it".
It's not a revenue source for the government (which it would be in the US). The wording is loose deliberately so that the regulator has the power to enforce the spirit of the regulation without getting tied into knots by the letter of it.
So yeah, I get that it's freaking people out. And there are costs in adapting processes. But, to be honest, if those processes need adapting then they were probably doing the wrong thing in the first place. Also, the EU gave everyone years of warning, and nobody paid any attention to that.
If the regulator finds out that one of your staff scribbled down a customer's phone number once on a piece of paper while serving that customer, they won't care. If they find that your customer service process requires your customer service staff to scribble down phone numbers on scraps of paper that are then put out with the garbage, where they can be dumpster-dived, they will care (and so should you).
This is not some huge regulatory over-reach that will force you to go through every piece of paper in your organisation. It's a check on your data handling that forces you to acknowledge the trust placed in you by your customers.