Am I right that the only risk for a small, side project for non-compliance are the EU legal sanctions should they grow to a significant enough size as to open a

Am I right that the only risk for a small, side project for non-compliance are the EU legal sanctions should they grow to a significant enough size as to open an EU office? Other than they, why shouldn't a US side project ignore the DSARs?