Everything is, there was a big deal here in the Netherlands about the local governments having to be compliant as well. The first thing that the dutch agency will check (no fines, but just make sure) is that each municipality has things set up properly.

On top of that, I don't think there's anything in the GDPR limiting it to internet related things, so brick & mortar stores will have to be compliant as well, afaik.