There are various lower levels. It's "up to". Many of the things GDPR requires have been law in various parts of Europe for a long time (e.g. Germany), sometime

There are various lower levels. It's "up to". Many of the things GDPR requires have been law in various parts of Europe for a long time (e.g. Germany), sometimes in all of Europe. But the fines were so low that most companies said "eh, who cares" - now enforcement has teeth and it's panic all around.