It really should be defined by company size or revenue. If I my site goes viral and a small web app suddenly has 2M lines of logs, but my revenue is small/non-existent, then there's no reason to comply. If that pushes my revenue over 1M euros a year, you now get pushed into a zone where you should be compliant, and you have enough revenue to afford it as well.
Another comment in this thread indicated that "large scale" was any business in which 5 employees or more had access to the data in the course of normal business operations.
Not exactly an ironclad source, but better than nothing, hopefully.
