Laws are not code. You could have the exemption be based on the number of individuals whose data is processed, for example: Facebook can use as many shells as they want, but they'd still need to comply if they want to look at their massive user base, but my small business with a few dozen customers wouldn't need to worry.