GDPR Compliance for Small Business: A Practical No-Jargon Guide

What GDPR Actually Requires From Small Businesses

The General Data Protection Regulation (GDPR) applies to any organisation that processes personal data of individuals in the EU - regardless of size or location. This means GDPR covers sole traders and every small business that stores customer email addresses, runs a CRM, or operates an online ordering system. The most frequently violated requirements for small businesses are: an inadequate or missing privacy policy, insufficient database security, and unlawful processing of personal data for marketing purposes.

The core principles of GDPR are: lawfulness, fairness, and transparency (customers must understand why and how you process their data); purpose limitation (data may only be used for the purpose it was collected for); data minimisation (collect only what you genuinely need); and accuracy. For a small business, implementing these principles is mostly a matter of organisation and documentation - not expensive technical systems.

When You Need Consent and When Legitimate Interest Applies

Common misconception: GDPR does not require consent for every data processing activity. There are six legal bases, of which two are most commonly relevant for small businesses: consent and legitimate interest. Consent is required for marketing emails to new contacts - it must be explicit, freely given, and revocable. For fulfilling a contract (for example, processing an order), you do not need consent - contract performance is a separate legal basis.

Legitimate interest is the basis for processing existing customers' data for related purposes (such as informing them about similar services). However, legitimate interest is not a blanket permission - it requires balancing your business interest against the individual's rights. For each type of processing, document which legal basis applies. This internal record is called the Record of Processing Activities (ROPA) and is a legal requirement for most businesses.

The Documentation and Technical Measures You Must Implement

A minimum GDPR compliance package for a small business includes: (1) A privacy policy on your website - clear and readable, describing what data you collect, why, how long you keep it, and what rights individuals have. (2) A Record of Processing Activities (ROPA) - an internal document cataloguing all personal data processing in your business. (3) A procedure for handling data subject requests - when a request comes in for access, correction, or erasure, you must respond within 30 days. (4) A data breach response procedure - in case of a data breach, you must notify the supervisory authority within 72 hours.

Technically: protect databases with passwords and access controls, back up data regularly, and ensure that third-party providers (such as cloud services) process data in compliance with GDPR - for this you need a Data Processing Agreement (DPA) with each provider.

GDPR Fines and How to Protect Your Business

GDPR fines operate on a two-tier scale: up to 10 million EUR or 2% of global annual turnover for less serious violations (administrative requirements), and up to 20 million EUR or 4% of turnover for more serious violations (core principles, data subject rights). For small businesses, fines are typically lower, but supervisory authorities across the EU regularly issue fines of 5,000 to 50,000 EUR to small organisations for preventable failures.

The best protection against a fine is documentation: if you have a ROPA, a privacy policy, and DPAs with your processors, you are in a substantially better position during an investigation. Entexia supports GDPR compliance with built-in access control, audit logging, and data export functionality for responding to subject access requests. Try it free for 7 days.