Most of the GDPR only applies to large enterprises and public sector bodies. Article 30 of the regulation says that organisations with less than 250 employees will not be bound by GDPR.