By law it is enforceable and directed at any entity that tracks European data. There is no clause the limits GDPR to large companies, just like there is no clau

By law it is enforceable and directed at any entity that tracks European data. There is no clause the limits GDPR to large companies, just like there is no clause that limits or restricts fines outside of the 4%/20M number. It would be entirely possible for someone to not be compliant with a side project and get fined 20M because there is nothing that explicitly forbids this it is entirely up to interpretation. Given that US companies have already been targeted in the EU, unfairly [1], I find that law terrifying because I have to trust regulators that don’t have my best interests in mind with possible penalties that are very high. [1] https://www.treasury.gov/resource-center/tax-policy/treaties/Documents/White-Paper-State-Aid.pdf https://www.treasury.gov/resource-center/tax-policy/treaties...