Snort, the GDPR is fairly hostile to small players by pretending they don't exist when they wrote the law. It's like signing a contract with employee hostile clauses that the employer pinky swears they will never use.

There is probably a similar pattern of ignore the small players in other new EU laws, but since it's not my industry I don't hear about them.