It is nice that you think that but actually startups have the least amount of problems regarding GDPR. You can start coding with GDPR in mind (privacy by design) and you will hardly have a lot of problems. Big companies have huge codebases and databases and they will have to integrate privacy into them which is FAR more complicated than any startup can even imagine. On the other side, if you are doing startup where you want to use privacy breaching as a business model, then you shouldnt exist in a first place, so no damage done.