GDPR did a lot through fear alone. Companies really stepped up their game. At least the small and medium ones. The big ones knew that laws are only laws if they are enforced and that it's going to take "a while" for that to happen, and it will probably happen only partially. But the most important part was that now people have an increased expectation of privacy (even if it's still lower than even what GDPR prescribes in most cases).

But GDPR is just the 2nd step. The 3rd is the e-privacy regulation that is coming, hopefully in this mandate.