I agree. GDPR doesn't explicitly state that companies above certain size are exempt for many nuances of compliance or the 'little guy' gets a pass. Yet, almost all small companies ignore full GDPR compliance. Just because no one cares/sues small companies, doesn't mean that they're immune - the letter of the law and its enforcement should be absolute so that shitty laws don't pass the mustard.