Complete rubbish about the fines. Monetary penalty fines - as I explained in the Tavern podcast - are only applied as the fourth stage of an exhaustive cooperative engagement process between the regulator and the organisation, or in the cases of genuinely egregious data breaches. The fines are proportionate and necessary, not maximum and destructive. (As a word of advice to readers, the most blatant sign of GDPRubbish is anything discussing fines whatsoever.)

As a UK business, you'll know that very little of what's in GDPR is new. All of its basic principles have been around since 1995, incorporated domestically as the DPA of 1998. You also know that GDPR will continue to apply within the UK through the new domestic implementation, the Data Protection Bill, after the UK leaves the EU and for several years beyond that.

The only horror to consider is that your data protection obligations for both your domestic and foreign customers - including the ones you describe above as "GDPR requires" - seem to be new to you after twenty three years of being on the books.

PS On Tuesday geoblocking became illegal within Europe.