Regulation would extend to data centres and managed IT service providers. Small businesses will meet it indirectly — through their contracts with suppliers.