> too strict for small businesses and non-profits

Maybe just calibrated poorly. Small enough and IMO the only important rule is no sharing with others. That should always be strictly enforced. But why worry about how some small timer handles my personal data or if I can make various requests of him? The stakes are too small to matter.