When I said small I was thinking more about <$250k a year in revenue. At that size I think the companies would be small enough that their lobbying wouldn't matter.

If you're in the millions a year in revenue then I don't see how understanding and complying with GDPR would be a large barrier. Even $250k might be too high.