Ah, this one I experienced myself.
At least in Poland the requirements before GDPR was the same for small startups and for large enterprises. If you wanted to set up a newsletter for a bunch of friends you had to do, technically, the same requirements and reports as the large telcos.
The only way to manage it was to effectively ignore it. I’ve met people who were afraid of setting up a landing page because you technically had to fill in paperwork and whatnot.
Ditto managing VAT across the borders and a bunch of other stuff.
It is better now in some ways - I think some newer regulations had it written down that they apply above a certain turnover threshold. We also we have saas-es to deal with a lot of beauricratic bs, and now also agents.
But I imagine for more human/real-world stuff the issues can’t be overcome with tech. E.g. if you hire a 4th team member and that person immediately goes into months-long health/birth timeout, it can derail a whole project. We barely avoided that once - didn’t hire a person due to culture fit, but we later suspected they planned to take a leave shortly after getting hired. It’s a common thing in bigger corps but they can afford it.
As a side note, in Poland used to have a lot of such BS, but our general culture is about hacking around it.
For example it’s common for smaller companies to have employees „self employed” to avoid most of regulatory burden of hiring, whereas the bigger companies need to have employees actually employed with all the legal consequences. Technically anyone can get audited but below 20-50 people the government won’t bother, so it balances itself out.
Germany is another animal altogether - the last time I was doing business there you couldn’t even theoretically open a new company at all because they had a catch 22. To open a company you had to have a bank account to pay the notary, and to open an account you had to have a company. And either the notary or the bank had to blink.