Many small business owners—especially those running a one-person business—assume that GDPR doesn’t really apply to them.