There’s nothing written in GDPR that would prevent a small business from surviving and being productive. It’s also important to understand that the law enforcement is business friendly in general: if you don’t do stupid thing intentionally, but occasionally make a mistake, no one will punish you.