It seems unlikely that anyone in good faith would get screwed by this. Most small businesses don't have a lot of outside investment, if any. If you're running

It seems unlikely that anyone in good faith would get screwed by this. Most small businesses don't have a lot of outside investment, if any. If you're running a bootstrapped business funded with your own savings, the last thing you need is to have to spend significant time and money figuring out where you stand on GDPR compliance and what you have to do with regards to any other organisations that your business in turn depends on. The theoretical fines aren't the most immediate problem for small businesses; the overheads are.