Enforcement is thin, but every large company operating in the EU pays for legal advice. It's a racket, if you are a large target you will do well to pay for external firms that employ people who personally participated in the establishment of the GDPR regime. This is a tax on the European business - one of many types.