GDPR fines are based on revenue, not assets. But to an extent this is correct; big companies are much more scared of the GDPR than small companies just because the amounts involved get so huge.