I have the feeling nobody knows this. To me it seems this part of GDPR is particularly targeted at major companies and they can be held accountable through subs

I have the feeling nobody knows this. To me it seems this part of GDPR is particularly targeted at major companies and they can be held accountable through subsidiaries or branch offices in the EU. It doesn't seem very likely to me that small businesses that happen to sell to EU customers too will be the primary target of enforcement anytime soon.