Replying to @castrotech
A small business that considered itself to fall under Article 37.1b conditions would pretty much have to be running a personal data business. Assuming that 10% does not seem very conservative at all, neither does 25% of medium ones.