> we try to not collect any data we don‘t absolutely need
Do you have analytics/telemetry for your products/websites? Do you include 3rd party fonts, libraries or use a CDN or a anti-DDOS service like CloudFlare?
Do you have data scrubbing capabilities in all your user-interaction software with a default maximum retention period? Do you answer data removal requests?
These are some the requirements for organizations of any size, big or small.