Clearly the EU wants to give companies the time to adapt.

Internet privacy has been a laissez-faire dystopian wasteland for decades.

Even with the current very gentle enforcement, GDPR has received a lot of push back and called draconian (by those who benefit from corporate surveillance).