In reply to Common Sense.

@Common Sense

Your reading is incorrect - Article 30, Section 5 pertains to the obligation to document records of processing activities, which is roughly 1/12th of what GDPR comprises.

Early drafts of GDPR proposed derogations for small businesses but these were removed from the final draft. Quite right too: why should, say, a 10 person app development studio conducting highly intrusive data collection and sharing about individuals be exempt from privacy protections based solely on their headcount?