Data protection battle fought at the expense of small businesses