The GDPR always applies regardless of whether a company is profitable or not. But it covers only personal data/sensible data, not "all data".