Strategy theory recognises outer general environmental mutations in the legal landscape as compelling dynamic forces of business competition. Thus, the latest EU directive on data protection constitutes an uncharted event for testing organisational adaptability. This research aims to understand the impact of GDPR and the endeavours towards the strategic fitness of firm. Thus, a theoretical critical review addresses both the field of business-level strategy and the GDPR phenomenon. An exploratory case research focuses upon the target population of SMEs with a purposive sample and embedded units seek the saturation point of data within the case, and the attainment of analytical generalisation. A mono-method of vis-à-vis enquiry articulates with content analysis. The latter encompasses an aprioristic design and an unbiasing protocol. An environment change seems to generate a double looping effect in the business ecosystem. Effects are dyadic, comprising a zero-sum logic (strategy adaptation), and a positive-sum (business and environmental evolvement).