RULEWELD / PRACTICAL GUIDE

GDPR basics for small companies.

A clear first pass for teams that collect, use, store, or share information about people.

THE STARTING POINT

Company size alone is not an exemption.

If GDPR applies to your business, being small does not remove its core duties. Which specific obligations apply depends on what you do with personal data, the risks to people, and your role in the processing. The European Commission explains the scope for businesses; the binding rules are in the GDPR itself. GDPR Articles 3–4·European Commission: application of the GDPR

A PRACTICAL FIRST PASS

Five things to put in order

Map the data and why you use it

List the people and data involved in each purpose: customers, staff, applicants, or suppliers; what you collect; where it comes from and goes; which tools or providers handle it; how long you keep it; and how it is deleted. Note whether you decide the purpose and means (controller) or act on another organisation’s instructions (processor). This map helps you answer rights requests and spot unnecessary collection. GDPR Articles 4 and 30·EDPB: data protection basics

Choose a lawful basis for each purpose

Before processing, identify and record the basis that fits the purpose: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Consent is not a default for every activity. Some sensitive (special-category) data also needs a separate condition under Article 9. GDPR Articles 6 and 9·EDPB: data protection basics

Explain the processing to people

Give clear, accessible information about who you are, why you use the data, your lawful basis, relevant recipients, retention, people’s rights, and how to contact you. Usually provide it when you collect the data; indirect collection has different timing rules. Update it before a material change in purpose. GDPR Articles 12–14·EDPB: respect individuals’ rights

Make rights requests somebody’s job

Set up a way to receive, verify, track, and respond to requests for access, correction, deletion, restriction, portability, or objection. The usual response deadline is one month; a permitted extension of up to two more months requires telling the person within the first month. Rights have conditions and exceptions, so assess each request rather than promising every outcome. GDPR Articles 12–22·EDPB: handling rights requests

Match security to the risks

Choose proportionate technical and organisational safeguards. Start with who can access data, strong authentication, staff practices, safe sharing, updates, backups, recovery, and checks that safeguards work. Consider the sensitivity, amount, context, and possible impact on people; the GDPR does not prescribe one identical security checklist for every company. GDPR Articles 25 and 32·EDPB: secure personal data

CONTEXT CHANGES THE ANSWER

Four duties to check against your processing

These are not automatic triggers for every small business. Review the legal tests against the actual activity, including applicable national rules.

A / RECORDS

Records of processing

Article 30 generally requires controllers and processors to keep written records of their processing activities. An organisation with fewer than 250 employees is excused only where processing is occasional, unlikely to risk people’s rights and freedoms, and does not include special-category or criminal conviction/offence data. Regular processing or any of those risk/data conditions removes that exception. A short data map is still a useful starting point.

Binding text: Article 30(5)Commission SME explanation EDPB: be compliant

B / DPIA

Data protection impact assessment

Assess before processing that is likely to create a high risk to people. The GDPR names large-scale processing of sensitive or criminal-conviction data, certain extensive automated evaluations, and large-scale monitoring of public areas as examples. National supervisory authorities may publish additional lists. Binding text: Article 35·EDPB: DPIA guidance

C / DPO

Data Protection Officer

A DPO is required when core activities involve large-scale regular and systematic monitoring of people, or large-scale processing of special-category or criminal-conviction/offence data. Ordinary support work such as payroll does not by itself make data processing a company’s core activity. Company size alone does not decide this test. Binding text: Article 37·EDPB: DPO criteria

D / BREACH

Personal data breach response

Have a way to contain, assess, and document incidents involving personal data. If a breach is likely to risk people’s rights and freedoms, the controller generally must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. If high risk is likely, affected people generally must also be told without undue delay. A processor must alert its controller without undue delay. Binding text: Articles 33–34·EDPB: data breaches

CHECK THE PRIMARY MATERIAL

Sources and authority

The distinction matters: legislation is binding law; the Commission and EDPB pages below are explanatory guidance, not legislation.

BINDING LEGISLATION

Regulation (EU) 2016/679

The GDPR text cited throughout this guide, including Articles 3–6, 12–22, 25, 30, 32–35, and 37.

Read the GDPR on EUR-Lex

EXPLANATORY GUIDANCE

European Commission and EDPB

This guide is a general orientation, not legal advice. It does not evaluate any individual company, cover every national rule or processing scenario, or guarantee that a business complies with the GDPR.

Read the Ruleweld FAQ