GDPR is referring to the EU recommendation Article
2 of the Annex to Commission Recommendation 2003/
361/EC. That's where the number 250 originates from.
>Staff headcount and financial ceilings determining enterprise categories
> 1. The category of micro, small and medium-sized enterprises (SMEs) is made up of enterprises which employ fewer than 250 persons and which have an annual turnover not exceeding EUR 50 million, and/or an annual balance sheet total not exceeding EUR 43 million.
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...
>Staff headcount and financial ceilings determining enterprise categories
> 1. The category of micro, small and medium-sized enterprises (SMEs) is made up of enterprises which employ fewer than 250 persons and which have an annual turnover not exceeding EUR 50 million, and/or an annual balance sheet total not exceeding EUR 43 million.