GDPR isn’t theatre in many organisations. Yes large tech firms (mostly US) probably ignore or circumvent. But most businesses I’ve worked for have taken concrete steps to reduce the data they hold and consider how it’s being used asa direct consequence of gdpr.