I wouldn't be at all surprised if it's actually cheaper for smaller businesses to properly handle personal data than it is for big ones. Big ones tend to have much bigger, more complex data systems that require complicated oversight and governance, and are presumably much more likely to engage in risky behaviors like dumping stuff into a data lake.

This might have an outsize impact on startups that deal primarily in data about people. I'm actually pretty OK with that. Some kinds of activities really should have high barriers to entry.