Unfortunately that regulation does not work well in practice. For example, I sent a request to Instagram for them to explain what they did with my personal data under GDPR. They sent me back a canned response and when I complained that the response does not answer my questions, they sent another canned response and from there they just completely ignore my emails. Now I understand the next step is to make a complaint to appropriate government body, but I fear if I do that my accounts will be deleted. That would be okay, but a lot of my family uses websites owned by Facebook and it means I would have difficulty contacting them. I think I shouldn't be penalised for wanting to exercise my rights.

edit: The fact that Instagram can ignore GDPR requests essentially means the law is dead.