My chief concern is that this will end up being an instrument wielded by big business (through political connections) at the expense of smaller companies, especially smaller overseas competitors but also domestically. If EU-US relations continue to sour, it could also become a weapon in a hypothetical trade war, which I guess is probably one of the "benefits" from an EU government perspective.
Codifying privacy protection is important, but GDPR favors big companies and governments too strongly over already risk-burdened entrepreneurs.