Its pretty enforceable. It is enforced for large corporations promptly, and you would be surprised, but if someone reports a small website from an individual or small corporation, they also get the law applied to them. Eu's enforcement website has a lot of local businesses and individuals who had collected people's emails without their permission (buying them from warez sites etc), sending out spam emails then got fined for violating GDPR for collecting data without the knowledge and consent of those people.