Before the GDPR came into effect, I had to deal with both the German Bundesdatenschutzgesetz and the Italian Codice in materia di dati personali, and recall them having very similar provisions (though I am not a lawyer). When the GDPR arrived, I found it equally similar to these two.
As far as I can tell, the major changes of the GDPR are maximum fines for violations, as well as some refinements (e.g. what data falls under “special categories”, the processing of which is subject to further restrictions).
Now, with the GDPR in force, I frequently hear statements (from people who are also not lawyers, all of them in a German context) to the effect that the GDPR changes everything, and every practice based on national data protection law becomes obsolete. My reading of the GDPR is a different one—IMHO the measures required for compliance with national data protection law are not very different from those required for GDPR compliance, save for a handful of exceptions or refinements.
Have I overlooked something here?