If those the are critical of GDPR had actually understood what it was about perhaps they would be less critical, it's all about protecting individuals rights, if you fill in an order form on a website with your personal details, name, address etc, you want to know that a. your details are not going to be easily hacked and b. the website owner is not going to sell your details to other people without your permission, this is the basis for GDPR, now if you are based outside the EU it may be harder to prosecute you for breaking the EU laws but its very easy for the EU to block websites that do not comply.