Don't think of regulation as a binary - on or off. Instead, think of it as an adjustable knob.

The higher you turn the knob, the harder it becomes to (compliantly) do things. Also (if the regulations are working as they should), the less the things that people do produce bad side effects. But the "harder to do things" part mean that fewer things get done - fewer new products and services get created. As the knob goes higher, not all of the things that don't get done are things that the regulations are designed to prevent. Some are perfectly fine things, but the burden of proving it is too much for the single person tinkering in their apartment to ever try to turn their idea into releasable reality.

Sure, I agree with the knob analogy. I just don't think this puts that knob anywhere near too high. Quite frankly, if this industry was guided by ethics, most of these things would be things that companies are already doing.

"This" (GDPR) may not. There's more than one regulation that make up "regulations", though. It's the total load that's the issue, not one directive.

I don't believe the entire load is anywhere near there, then. Also, for a lot of these things, once you have the procedures in place, maintaining compliance does not take much effort.

I highly doubt it is deliberately anti small business. However, governments don't actually know what the outcome of their laws will be until they are out in the open and if governments claim to know what the outcome will be, they are likely lying.