I’m a little surprised then, because the only problem I see for basic GDPR compliance for a single founder is if their business model is based on monetising their users’ data. Which is going to be a problem, regardless of the size of the organisation.