Does the GDPR also apply to freelancers and small businesses?

Yes, freelancers and small businesses are also covered

The GDPR applies to everyone who processes personal data, regardless of the size of the business. There is no minimum threshold in the law regarding the number of employees or turnover. As soon as names, email addresses, invoices containing customer data, personnel records, or a customer database in a CRM system are kept, there is processing of personal data within the meaning of the law — and therefore the GDPR applies. A self-employed person with three customers in a spreadsheet falls under it just as much as a company with a hundred employees.

What does differ, however, is the scope of the obligations that follow from that applicability. For example, the GDPR provides a lighter exception for maintaining a processing activity log: organisations with fewer than 250 employees do not in principle need to keep that log, unless the processing is not occasional, carries a risk to the rights of data subjects, or concerns special categories of data. In practice, that exception reaches much smaller businesses less far than it seems to promise at first sight, because keeping customer data is rarely truly occasional.

Where this follows from: Article 2 and Article 30 GDPR

The material scope of the GDPR is set out in Article 2: the regulation applies to wholly or partly automated processing of personal data, and to processing that is part of a filing system. The exception to the record-keeping obligation for smaller organisations is set out in Article 30, with the conditions stated therein. Because the GDPR is a regulation, this core applies directly and uniformly in every Member State — in the Netherlands just as much as in Germany. What does differ per country is which supervisory authority oversees it: in the Netherlands it is the Authority for Personal Data, in Germany it is the supervisory authority of the state in which the establishment is located.