Article 83, paragraph 5 says I can be fined 20 mil EUR (or 4% of revenue, whichever is greater...so 20 mil would be the number for me). You might say, "well don't break the law" (like that's an excuse for punishments some types of companies can afford and others can't) or "no, that's only for big companies" (like it's ok to rely on subjective enforcement). I'd rather just not risk going bankrupt or prevent myself from doing business in the EU until I'm big enough to handle that.

> All this data

What, from my two large customers? So EU says I violated article 5 and the personal data wasn't "processed lawfully, fairly and in a transparent manner in relation to the data subject". Ug, such subjectivity. It is so sad to see so many people want solutions to these problems that they assume the GPDR is it. I can't do business there just praying I don't misstep and go bankrupt or subjecting myself to the whims of these loaded terms like "transparency" until I am large enough to absorb the blow.

I get your point, but say you were selling food instead of services. It's on you to make sure that what you are importing doesn't break any rule (GMO, other stuff, etc...).

I think it's fair. You shouldn't break the law. That regulation may be overkill in terms of punishment, but that doesn't mean that the regulation itself is wrong. Laws are imperfect. Regulations exist in every industry and there's a reason for that. Over regulating is a burden for a business, but under regulating is bad for customers (or the environment, or whatever).