Data protection obligations apply to all companies, regardless of their size or number of employees.