To clarify Ms Kolding's questions:

Part of the accountability principle, for organisations engaging in large-scale data processing, is to appoint a position known as the data protection officer. This is an individual with responsibilities for monitoring compliance with GDPR. One of their duties must be to act as the point of contact for the supervisory authority, meaning the data protection regulator, in the member state where the company has noted its European presence. Identifying which European country a business is accountable in, and registering accordingly, is also a requirement under GDPR for businesses large enough to merit a DPO. If a European citizen is not happy about the way that, say, Infocore is processing their personal data, they will be able to register a concern with the data protection regulator in the member state where Infocore must note its registration.

That data protection authority is not some jack-booted platoon of "absolute power". (Really, "search and seize"? This isn't CSI Brussels.) DPAs are rather geeky professionals in an office who will ask the company to demonstrate their accountability principles and documented compliance. If the regulator is actually rather nice, like the UK's ICO, they will work constructively with the company to lead them to healthy compliance without imposing penalties or fines. On that matter, penalties and fines are only imposed after the company has exhausted all of the options presented to them by the regulator, has refused to work with them, or has committed a preventable data breach of absolutely monumental stupidity (BPAS comes to mind.)

GDPR is not the EU "enforcing a broad mandate outside its borders." GDPR means companies doing business in Europe, collecting data on European citizens *in its borders*, become accountable to those people via the data protection regulators in the countries where those people live. Companies which are not happy with that accountability do not have to do business in Europe.

To frame GDPR as some sort of evil government monolith interfering with the soverignty of private businesses in other countries is to defend the abuses of privacy by the marketing and advertising industries which have largely inspired the data protection overhaul in the first place. As of 25 May 2018 those excuses will no longer wash.