One positive effect you can already see: people think about privacy laws. Most of the GDPR was already law in various EU countries, just largely ignored by everybody. GDPR gave the laws more teeth and publicity.

For real improvements, we will have to wait a few years to find out what and who regulators will persue for violations, and how the courts interpret the GDPR. If regulators never look at small companies, the second order effects on small companies will vanish. If regulators miss to successfully prosecute the obvious violations by tech giants, no meaningful effects will stay at all. It all comes down to what regulators will do, and it's way too early to tell.