That's not what's being discussed. My comment asserts with certainty that a small business will never be punished as leverage against the upstream big corp.
It's not Microsofts fault if customers use it to store GDPR relevant data. It's Microsofts customers using them as an external data processor. It's the companies that are using O356 for such data that will get fined.