As someone who doesn't deal with Europe much... CASL here in Canada seems to have similar rules. Would following CASL automatically mean it follows GDPR?
The UK has had data protection laws for years, people aren't scared of GDPR because it finally provides laws, they're scared because they actually look enforceable.