However, the devil's in the details, specifically in how these principles are supposed to be implemented. Some of these details are not quite clear yet. It's almost impossible to navigate these issues without getting at least some basic legal advice and investing a fair bit of time.
Unfortunately, as often is the case with EU regulations these seem to be targeted mainly at larger companies or corporations, which can easily afford this because they have legal departments anyway.
As a company that uses third-party services for data processing (which includes almost every piece of SaaS-type software) you have to sign a data processing agreement with each of those, which can mean considerable effort.
Some suppliers unfortunately are not as well-prepared yet as they should be.
Therefore now a company's processes continuing to run smoothly might depend on some third party getting their internal affairs in order. It's true they should've done this long before and one shouldn't continue to work with them if they fail to do so. Still, it's a problem you have to deal with.
I agree that GDPR makes sense and it's a good idea to follow through with these measures. It won't be easy in each and every case though and it might be a bumpy ride at first, which is why I sincerely hope that in the beginning authorities will be lenient with parties that act in good faith.