IIRC GDPR is considered regressive, in the same sense that a flat corporate tax is regressive: it imposes a higher burden on small bootstrapped companies than it does on larger companies (in this case, because of the legal fees required to get audited for compliance, and the extra engineering work that's not going toward product.) Very small companies can get priced out of the market entirely, and so never live to become large companies. Insofar as those companies were potential innovators, GDPR can be said to be stifling that innovation.