> Most of the rules in GDPR apply only to personally-identifiable information that is not strictly required for business operations.

I'm sure there are some provisions intended to help out smaller entities. But the compliance cost is the cost of understanding the legislation so you can comply with it. You still have to pay it even if it turns out not to apply at all -- because you can't know that until you go through all of it first.