Actually, the GDPR only defines a minimal baseline for all the EU countries to meet. And countries didn't need to update their own laws to match it: since it is

Actually, the GDPR only defines a minimal baseline for all the EU countries to meet. And countries didn't need to update their own laws to match it: since it is a Regulation rather than a Directive, the GDPR is enforcable in the entire EU even without a local law supporting it. Countries are still free to enact stricter policies if they want to, but those obviously wouldn't apply outside their own national borders.