Smaller businesses have been particularly hit by the cost of compliance with the GDPR. And regulators have struggled to apply the rules to emerging technologies such as AI, blockchain and the internet of things, according to a confidential report draft.