I think GDPR should be based on Gltd's and ccGltd's. That way you know when you leave the comfort of a .nl or .eu and enter the .com you have been warned. Just like signing an agreement that says which state laws you agree the contract uses.