Most of the time they don't.
Ever wonder why food health and safety inspections discover serious issues in basically all restaurants they inspect?
It's because people owning and operating restaurants usually aren't knowledgable enough about these topics, don't have the time or don't have the money to things differently or all three at the same time.
Most restaurants stay in business because the inspection are generally pretty lenient (issue warnings and don't close the business down) and are also understaffed compared to the number of businesses that have to be inspected.
This is a simple example and I'm purposefully targeting a part of the law (food health and safety) that is directly linked to the core business (restaurants). I'm not even going into issues that could be found in other areas (accounting, human resources, etc.) of said business.
Now let's try to imagine how a restaurant is going to approach GDPR compliance.