Unfortunately, the standard MO for the EU is to hang the Sword of Damocles over the head of small organisations itself by passing regulations obviously aimed at

Unfortunately, the standard MO for the EU is to hang the Sword of Damocles over the head of small organisations itself by passing regulations obviously aimed at problems that normally come with much larger organisations. It does it with VAT. It does it with the consumer protection rules. Now it's doing it with the privacy and data protection rules. The moderating effect is that organisations too small to have dedicated in-house staff to deal with these kinds of issues are probably too small for resource-constrained regulators to bother with. If you're responsible for one of those small organisations, your choices are typically to try to stay on the right side of the law but in doing so accept disproportionate overheads for something that probably won't ever matter, or not to try, not to incur the overheads, and to hope that you don't get caught and penalised, which realistically you probably won't unless something happens that is so catastrophic that your organisation has already ceased to exist anyway. As far as smaller businesses are concerned, these kinds of rules hand a big competitive advantage to those who don't make a good faith attempt to follow them, at the expense of those who try to do the right thing legally speaking. As someone who is generally a strong believer in doing the right thing in business, and in fair consumer protections and strong privacy rights from a personal point of view, I find this outcome infuriating.