Businesses will do enough to pass the sniff test of proper compliance with GDPR, and no more. I've worked with enough to know most mid sized orgs are far too reactive, too technically incompetent, and far too busy making money to do a proper job on adhering. Most flout existing laws already, I don't think they'll be scared of disregarding elements of this too.
I know that there is a HUGE concern about the fines that can be used to backup GDPR.
I know of US companies that have a EU presence legally (but with little income from EU) that are considering just blocking EU traffic as a way to stay safe and smallest over-head.
Many countries in the EU have a great standard of living by focussing on individual's rights vs companies. Well, I say focussing. From our perspective, it's just normal and a good balance. But if you live in a country where companies can screw you over in a million ways ("at will" employment, arbitration, NDAs, etc.), maybe such rights might seem a bit alien.
And if you've tried to comply with the law, but unintentionally fail to handle some edge-case with low impact, the sanctions are pretty light (e.g. a warning letter). It's not draconian, as long as you don't cut corners.
Also, the fines here can be real money, which also isn't often the case. That plus the lack of clarity are why people are concerned about it.
Basically they're worried that you can do everything right and still be wrong because everything isn't well defined and is very difficult to define.
I also disagree with you that the EU regulations are a good balance - it’s skewed way too far towards over-regulation.
I think this will change the world, just as the EUs push for lead-free soldering did.
After the Equifax thing it's not looking like a very solid bet.
While some outfits may blithely whistle past the graveyard - do you want to become the precedent that starts paying the % of revenue fine for non-compliance?