I agree, large companies weren't the targets. Ultimately large companies are always better position to respond to regulation than small companies anyway.

However, just because you're a small company doesn't necessarily mean you're dealing with small data anymore. The data broker companies mentioned in the articles are great examples. These companies are the next Cambridge Analytica if not regulated by laws like this.