For new businesses, most support tickets will probably be handled manually. This could even include such mundane things as "could you reset my password" (if you

For new businesses, most support tickets will probably be handled manually. This could even include such mundane things as "could you reset my password" (if you haven't bothered to implement a "forgot my password" mechanism yet, which is perfectly reasonable). Another request could be, "could you delete my account and data". Normally, if a user asks you that, you should probably already do so anyway, GDPR just says that you must. It also says that if they ask for their data, you have to give it to them. If you don't have many users yet, not many such requests will come in, so I don't think this is an undue burden. In the beginning, the burden will be roughly proportional to the number of users you have. If the burden becomes too high, it's easily automatable. So personally I don't think an explicit exemption for small businesses is really necessary.