GDPR Basics: What Every Small Business Needs to Know

The General Data Protection Regulation — GDPR — is one of the most significant pieces of data privacy legislation in history. Since it took effect in May 2018, it has reshaped how businesses around the world collect, store, and use personal data. And despite common misconceptions, it doesn't just apply to European companies. If your small business collects data from anyone in the European Union — whether through a website, email list, or online sale — GDPR likely applies to you.

flowchart TD
    A["GDPR Compliance"] --> B["Map Personal Data"]
    B --> C["Legal Basis for Processing"]
    C --> D["Privacy Notices"]
    D --> E["Data Subject Rights"]
    E --> F["Breach Notification"]
    F --> G["Ongoing Compliance"]
  

For many small business owners, GDPR feels overwhelming. The regulation itself is hundreds of pages long, filled with legal terminology that seems designed to confuse rather than clarify. But the core principles are actually straightforward, and compliance doesn't have to be complicated or expensive. This guide breaks down what you actually need to know and do.

Does GDPR Apply to Your Business?

This is the first question every business owner asks, and the answer is simpler than you might think. GDPR applies to your business if:

• Your business is established in the EU or European Economic Area (EEA), regardless of where you process data.
• You offer goods or services to people in the EU, even if your business is based elsewhere. This includes having an EU-accessible website, accepting euros, or shipping to EU countries.
• You monitor the behavior of people in the EU — for example, through website analytics, targeted advertising, or tracking cookies.

If your website is accessible to EU visitors and uses Google Analytics, sets cookies, or collects email addresses, there's a strong argument that GDPR applies to you. It's based on the location of the individual whose data you're processing, not the location of your business.

GDPR follows the data subject, not the company. If you have even one customer, subscriber, or website visitor from the EU, the regulation likely applies to how you handle their data.

Key GDPR Principles

GDPR is built on seven foundational principles that guide everything else in the regulation. Understanding these principles is more important than memorizing specific articles:

1. Lawfulness, fairness, and transparency: You must have a legitimate legal reason to collect and use personal data, and you must be open about what you're doing with it.
2. Purpose limitation: You can only collect data for specific, stated purposes. You can't collect email addresses for a newsletter and then use them for something completely unrelated without additional consent.
3. Data minimization: Only collect the data you actually need. If you don't need someone's phone number, don't ask for it.
4. Accuracy: Keep personal data accurate and up to date. Provide ways for people to correct their information.
5. Storage limitation: Don't keep personal data longer than necessary. Set retention periods and delete data when it's no longer needed.
6. Integrity and confidentiality: Protect personal data with appropriate security measures — encryption, access controls, secure storage.
7. Accountability: You must be able to demonstrate compliance. Good intentions aren't enough — you need documentation.

Understanding Lawful Bases for Processing

Under GDPR, you need a legitimate legal basis to process personal data. There are six lawful bases, but for most small businesses, three are particularly relevant:

Consent

The individual has given clear, specific consent for you to process their data for a particular purpose. Consent must be freely given, informed, and easy to withdraw. Pre-checked boxes and buried terms don't count. If you're adding someone to your email marketing list, they need to actively opt in — and they need to be able to easily unsubscribe.

Contractual Necessity

You need to process the data to fulfill a contract with the individual. If someone buys a product from your online store, you need their shipping address to deliver it — that's processing necessary for the contract. You don't need separate consent for this.

Legitimate Interest

You have a legitimate business reason to process the data, and this doesn't override the individual's rights and interests. This is the most flexible basis but requires careful consideration. Sending a follow-up email to a recent customer about a related product might qualify. Adding random people to your marketing database doesn't.

Individual Rights Under GDPR

GDPR grants individuals significant rights over their personal data. Your business needs to be prepared to honor these rights when requested:

• Right of access: People can request a copy of all personal data you hold about them. You must respond within one month.
• Right to rectification: People can ask you to correct inaccurate data or complete incomplete data.
• Right to erasure ("right to be forgotten"): In certain circumstances, people can ask you to delete their personal data. This isn't absolute — you may need to retain some data for legal or contractual reasons.
• Right to restrict processing: People can ask you to limit how you use their data while disputes are resolved.
• Right to data portability: People can request their data in a commonly used, machine-readable format so they can transfer it to another service.
• Right to object: People can object to certain types of data processing, including direct marketing. If someone objects to marketing, you must stop immediately — no exceptions.

You should have a process in place to handle these requests before you receive one. Scrambling to figure out where all of someone's data is stored after they request it is stressful and risks missing the one-month deadline.

Privacy Notices and Transparency

GDPR requires you to tell people what you're doing with their data in clear, plain language. This is typically done through a privacy notice (or privacy policy) on your website and at the point of data collection.

Your privacy notice must include:

• Who you are (your business name and contact details).
• What data you collect and why.
• The lawful basis for each type of processing.
• Who you share data with (including third-party services like email platforms, analytics tools, and payment processors).
• How long you keep data.
• The rights individuals have and how to exercise them.
• Whether data is transferred outside the EU/EEA and what safeguards are in place.
• How to contact you or lodge a complaint with a supervisory authority.

For detailed guidance on crafting your privacy notice, see our article on privacy policy requirements for small businesses. The key is clarity — avoid legal jargon and write in language your customers can actually understand.

Data Breach Notification

Under GDPR, you must report certain types of personal data breaches to your relevant supervisory authority within 72 hours of becoming aware of them. If the breach poses a high risk to the rights and freedoms of the affected individuals, you must also notify those individuals directly.

Not every security incident qualifies as a reportable breach under GDPR. A breach is reportable when it's likely to result in a risk to people's rights and freedoms — for example, if financial data, health records, or credentials were exposed.

To meet the 72-hour deadline, you need:

1. A clear process for detecting and reporting breaches internally.
2. A designated person responsible for assessing breaches and making notification decisions.
3. Pre-drafted notification templates that can be quickly customized.
4. Contact information for your relevant supervisory authority.
5. A log of all breaches, even those you determine don't require notification — you need to document your reasoning.

For comprehensive guidance on notification obligations, see our article on breach notification requirements.

Practical Steps for GDPR Compliance

Compliance doesn't require hiring a team of lawyers or implementing expensive software. Here are practical steps any small business can take:

Step 1: Map Your Data

Create a simple spreadsheet documenting what personal data you collect, where it's stored, why you collect it, who has access to it, and how long you keep it. This is your data inventory — and it's the foundation of everything else.

Step 2: Review Your Consent Mechanisms

Are your email signup forms using clear opt-in language? Are your cookie consent banners giving people a genuine choice? Review every point where you collect consent and ensure it meets GDPR standards.

Step 3: Update Your Privacy Notice

Make sure your privacy policy covers all the required information listed above. If you're using a template from five years ago, it's time for a refresh.

Step 4: Secure Your Data

Implement appropriate security measures — encryption, strong passwords, multi-factor authentication, access controls, and regular backups. GDPR doesn't specify exact technical requirements, but it expects measures appropriate to the risk.

Step 5: Prepare for Data Subject Requests

Create a simple process for handling requests from individuals exercising their rights. Know where all personal data is stored so you can respond completely and within the one-month deadline.

Step 6: Review Your Vendors

Under GDPR, you're responsible for ensuring that any third parties processing personal data on your behalf (data processors) also comply. Review your vendor agreements and ensure they include GDPR-compliant data processing terms.

Step 7: Document Everything

GDPR's accountability principle means you need to demonstrate compliance, not just claim it. Document your policies, your data processing activities, your consent records, and your decision-making processes.

Perfect compliance from day one isn't realistic for most small businesses. What matters is demonstrating that you're taking data protection seriously, making genuine efforts to comply, and continuously improving your practices.

Your GDPR Compliance Checklist

Use this checklist to track your progress toward GDPR compliance:

1. Create a data inventory documenting what personal data you collect and why.
2. Identify the lawful basis for each type of data processing.
3. Update your privacy notice with all required information.
4. Review and fix consent mechanisms (email signups, cookie banners, forms).
5. Implement appropriate security measures for the data you hold.
6. Create a process for handling data subject access requests.
7. Develop a data breach response plan with notification procedures.
8. Review vendor agreements for GDPR-compliant data processing terms.
9. Set data retention periods and delete data you no longer need.
10. Train your team on data protection principles and your company's procedures.

GDPR may have started as a European regulation, but its influence is global. Similar privacy laws have been enacted or proposed in dozens of countries and US states. By building a solid GDPR compliance foundation today, you're not just meeting one regulation — you're preparing your business for the future of data privacy. And more importantly, you're building trust with your customers by treating their data with the respect it deserves.