Smaller companies — with fewer than 5,000 employees — in particular may be hit hard by GDPR requirements and other data compliance hurdles. A new report does the math.