I like how you, with actual concrete real-world experiences you are sharing, are being downvoted by silent armchair enthusiasts who mostly just like GDPR because they get the sense that it’s vaguely bad for Facebook.
As someone who implemented it in several companies, I don't like it because it hits smaller companies much harder than bigger ones, and because it tries to be technology agnostic it is quite fuzzy, compate to something like SOX or PCIDSS (which I also implemented as CTO). In Germany at least data protection agencies declared they will go after companies that use e.g. Mailchimp.
Maybe you were handling personal data correctly. Very many were not (witness numerous data breaches and private data exploited that was held for no reason). Therefore regulation was needed.
> We need more competition
Competition is good. A race to the bottom is not.
It also could’ve been implemented in such a way where there were no required new positions and the gov spent tax dollars to write a greatly detailed dummies guide to GDPR, how to implement it, etc so that smaller companies without the resources would have just as much of an advantage.