GDPR for small businesses: the parts that actually apply to you
You don't need a legal team to take the basics seriously. Most of what matters day to day comes down to a handful of practical habits.
GDPR often gets treated as either irrelevant to small businesses or as an overwhelming legal minefield, and neither is quite right. The full regulation is genuinely complex, and for anything involving significant risk — large-scale data processing, health information, marketing at scale — proper legal advice is worth getting. But the everyday practical side that applies to most small businesses is more manageable than it sounds.
In practice, it tends to come down to a handful of habits: only collecting personal data you actually need for a clear purpose, not keeping it indefinitely once that purpose is done, storing it somewhere reasonably secure with access limited to people who need it, and having a straightforward way to respond if someone asks what data you hold on them or asks you to delete it.
A few common trip-ups worth knowing about: marketing emails generally need clear consent, not just an assumption that someone wants to hear from you because they once bought something. Data shouldn't sit forever in old spreadsheets nobody's looked at in years, just because deleting it felt like extra work. And a data breach — a lost laptop, a compromised account — may need to be reported, depending on the risk involved, so it's worth knowing in advance who'd make that call.
None of this replaces proper legal advice for your specific situation, particularly if you handle anything sensitive. But for most small businesses, taking these basics seriously covers the large majority of everyday practical risk.