This is exactly the sort of scaremongering this article was trying to address.

Being compliant is about not abusing personal data. I think small companies will find that much easier to do than bigcorps whose business model is based on privacy invasion, like facebook or google.