This is true about a lot of regulations, e.g. slaughterhouse regulations in the USA. That doesn't mean you shouldn't have those regulations, or at least some version of those regulations.
Managing how the regulatory burden falls is a core part of lawmaking. GDPR fails in this respect.
Complain-investigate regimes (where complaints frequently trigger a regulatory interaction) are effective. They're also among the most-onerous forms of oversight. (Second to mandatory licensing and auditing.)
Add to that the power of each of the EU's twenty-eight national data regulators to interpret the rules. Result? A law that's great for Facebook and Google and terrible for almost anyone else. To wit, Facebook and Google's shares of EU advertising has risen since GDPR went into effect.
Isn't this the expected result? Now only a small number of (relatively) trusted companies have my data, not multiple fly-by-nights who may or may not be trusted ALL trying to gather it. To me, that's a net gain - Google/Facebook would have got that data _anyway_, but I now have less companies trying to gather it _as well_.
I'm not sure it's net negative in the case of the GDPR. As a sibling (cousin?) poster said, good riddance. No company should be allowed to mismanage my personal data, big or small. Until I see evidence that GDPR compliance is cost prohibitive enough to suppress startup formation, I won't be convinced that the tradeoff isn't worth it.
The other issue is philosophical. You seem to want proof that a company should exist and require extraordinary evidence against a law. I want proof that a law should exist and require extraordinary evidence against a company. As a shorthand its France vs America. You'll note that we're not using Minitel bur rather a board hosted by a VC operation who shares a mindset with the founding team of Uber.
Hazlitt: “The art of economics consists in looking not merely at the immediate but at the longer effects of any act or policy; it consists in tracing the consequences of that policy not merely for one group but for all groups.”