GDPR is easy as a small organization IF you are not greedy for other people‘s data. Keep your hands clean. I own (part of) a small company that makes software for a small market and we had absolutely no problems with GDPR because we try to not collect any data we don‘t absolutely need. It‘s not very complicated if you just invest some thought into your processes and don’t spy on your customers. Most of the time you don‘t need the data but someone wants to sell you a product to gather it.