I'm concerned about the impact GDPR has on small businesses. GDPR applies to every business regardless of size. This is how it should be in a state under the rule of law, after all.
For small businesses, however, the effort required for implementing GDPR is considerably larger in relative terms than it is for larger companies. Even if you don't process any data beyond what's necessary due to legitimate interest such as for accounting purposes the effort required for properly documenting your processes and third-party data processing can be quite considerable. Larger companies already do have lawyers to deal with this. As a small business owner you usually don't.
This in itself isn't all that bad. It's mostly a one-time effort and as an added benefit it allows you to rethink and streamline your processes.
However, some aspects of GDPR have been left rather open and ambiguous in terms of how to actually implement them (sometimes intentionally so to make the regulation somewhat future-proof). Please see this earlier comment on some issues that small business owners are faced with:
https://news.ycombinator.com/item?id=17099878
Some of that ambiguity and uncertainty opens up new opportunities for the practice of sending a certain type of cease-and-desist letters that already incurs a fine at first notice (e.g. for supposedly not meeting legal requirements such as having a properly worded privacy statement on your website). This practice is rampant in some areas and industries. So far unfortunately, neither the EU nor the member states this applies to have undertaken significant steps to fight this.
What really irks me is that EU officials dismissed these concerns on several occasions. It's almost as if for them SMBs simply don't exist and the world is all about Google and Facebook.
Framing the conversation as tech company winners and losers is to totally miss the point. The real question is whether GDPR will actually help stem data abuses, and frankly I don’t see how it can’t be at least a marginal net positive.