Yes, the GDPR pays particular attention to small and medium-sized enterprises. The risk-based approach means that data protection measures must be adapted to the respective controller and their processing activities. There is no blanket catalog of measures for everyone; instead, industry-specific methods can be used to achieve an acceptable level of data protection with reasonable effort.