GDPR doesn't have any minimum size before applying. There's a household exemption for personal use, but if you have one external user, you're regulated.