There is a €10 million minimum fine for non compliance -- €20 million for tier 2 offenders -- but there is scope for (internal) regional variation in GDPR's application so there is some wiggle room.

As @Matt rightly says, GDPR affects any person or business that collects data about anyone in the EU at the time of data collection.

GDPR defines Data Subject to be anyone who happens to be within an EU jurisdiction at the time their data is collected as well as persons normally resident within the EU (EU citizens). This Data Subject could be an EU citizen travelling in the US or an Australian citizen in transit across EU airspace. Data Controllers and Data Processors are equally tightly defined as those who collect, store and crunch data collected on EU Data Subjects.

Further, GDPR requires that those who own or manage properties where data is collected ensure the security of that data, record where that data is shared, notify Data Subjects of any data sharing or changes to the basis of any data collection and provide a route for data to be viewed by Data Subjects or deleted (including shared data -- see next).

Furthermore, GDPR puts the onus on Data Controllers to ensure those who might access that data are also GDPR compliant.

Are the horrors of this regulation beginning to reveal themselves to you?

How about this: what data is collected by your web server (stats and error logs), web host (data backups) and payment processors (e.g. Stripe and PayPal)?

When an EU Data Subject purchases a service or plugin, the vendor needs to be GDPR compliant whether that vendor is in the EU or not.

GDPR is too well written. This regulation will affect more people than most could have imagined when the documentation was finalised. In my opinion, GDPR will cause non EU businesses and website owners to reconsider their openness to persons covered by EU jurisdiction.

Myself, and I am in the UK, as soon the UK leaves the EU, I will review whether to geoblock Data Subjects within the EU. So little of my traffic and business is conducted in the EU I won't miss it and the costs of compliance are too high to warrant EU business.

GDPR is going to cause bigger headaches than many yet realise.