[blub]

Small companies can and do abuse personal data just as well.

I'll never forget how some period tracking app that my partner was using was updated with much more invasive privacy policy terms. It was take it or leave it, no way to use the app any more except by clicking the accept button.

It was a small European start up that did this.

So yes, GDPR applies to all sizes of companies.