This is going to affect every single place where data is collected and there are no excuses. I know because it will impact my business too (I am in online retail sales) A person will have the right to have their data deleted and request proof that you have done that. Physical data kept for tax reasons etc must be kept in a secure place. Policies will need to be in place including what processes are in place for a breach of security. It's very involved.
I struggle to see how JWs will comply. As mentioned above, a lot of info is kept on file in congregations.
I kind of want to request that all my data is deleted from the congregation even tho I am not DA/DF.
Even when the UK leave the EU the govt will still have the GDPR because it is necessary to protect people.
Failure to comply will carry some heavy penalties.