GDPR Q24
How does GDPR apply to small businesses?
Q24. How does GDPR apply to small businesses?
Category: Business Size
Small businesses must still follow GDPR. The rules are scalable, so focus on practical steps that fit your size and risk profile.
In simple terms
- Follow the same principles as larger organisations.
- Some record-keeping exemptions exist, but many small firms still need records.
- Training and simple policies go a long way.
Core obligations
Regardless of size, you must identify lawful bases, respect rights, keep data secure, and handle breaches properly.
- Maintain privacy notices and respond to SARs within one month.
- Keep data minimised and up to date.
- Use strong passwords and restrict access to personal data.
Record-keeping flexibility
Organisations with fewer than 250 employees may not need detailed processing records unless processing is high risk, frequent, or involves special category data.
- Even if exempt, keeping simple records helps manage compliance.
- Document processing that could impact individuals significantly.
- Use templates to keep paperwork manageable.
Practical steps to take
- Map the personal data you hold and why you hold it.
- Draft concise policies for data protection, breaches, and retention.
- Provide staff or volunteers with basic privacy training.
- Review supplier contracts to ensure they include GDPR clauses.
- Schedule annual reviews to keep practices current.
Real-life examples
Local café
A café keeps a simple spreadsheet of loyalty scheme members, encrypts the file, and deletes inactive entries every six months.
Freelance designer
A sole trader uses secure cloud storage, keeps client contracts for seven years, and publishes a short privacy notice on their website.
Helpful reminders
- You may still need to pay the ICO data protection fee.
- Keep breach and SAR logs even if incidents are rare.
- Use affordable security tools like password managers and MFA.
Key takeaway
Small size is not an exemption—adopt proportionate controls and keep good records.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.