The GDPR Compliance Checklist for Small Businesses: 12 Steps to Avoid Fines

A bakery with a loyalty card. A five-person design studio. A plumber whose phone contacts double as a customer database. All of them hold personal data, and all of them sit inside the GDPR. There is no small-business exemption, and the penalties are real: the ceiling is €20 million or 4% of global annual turnover, whichever is higher.

In practice, though, fines rarely land on businesses that can show they tried. They land on the ones with a mailing list nobody properly opted into, a supplier contract silent on data, or no idea who to call when a laptop goes missing. The twelve steps below are ordered so the groundwork comes first. Work through them once and you end up with something more useful than a policy gathering dust: a set of habits.

The Twelve Steps at a Glance

1. Map what personal data you hold and where it lives.
2. Assign a lawful basis to every reason you use it.
3. Keep a short record of your processing activities.
4. Rewrite your privacy notice in plain language.
5. Fix how you collect consent.
6. Prune and re-permission your mailing lists.
7. Build a routine for access, correction and deletion requests.
8. Write a breach plan with a 72-hour clock.
9. Check supplier contracts for data protection clauses.
10. Review any data leaving the EEA and the safeguard behind it.
11. Set retention rules and basic security to match.
12. Name one responsible person and train everyone else.

The first three carry the most weight, so start there.

Map Your Data Before You Change Anything

You cannot protect what you have not written down. Spend an afternoon listing every place personal data appears: the CRM, the accounting package, the shared drive, the notebook by the till, your own inbox, the payroll provider. For each, note what it holds, why you have it, where it came from, who can see it, and how long you intend to keep it.

A spreadsheet with one column per question is enough. The point is to turn "I think that's in the system somewhere" into a list you can act on. Expect two or three surprises: an export from a former employee, a list shared with a partner years ago, a folder of CVs from a recruitment round that ended.

Assign a lawful basis to each use

For every purpose in your map, choose a basis: a contract (you need an address to deliver an order), a legal obligation (tax records), legitimate interests (fraud prevention), vital interests, public task, or consent. Consent is the weakest option because it can be withdrawn, so do not reach for it automatically. Marketing emails are the classic case where consent — or a properly assessed soft opt-in under ePrivacy rules — is the right route. If your reasoning is not written down, you cannot point to it later. This is general guidance, not legal advice; if you handle health data or large volumes of sensitive information, have a qualified adviser review your choices.

Keep a record of processing

Article 30 asks for a record of your processing activities. Smaller organisations get some relief, but the exemption is narrower than people assume — it does not cover processing that is regular, that carries risk, or that involves special categories of data. Since the map already exists, turning it into a one-page register costs almost nothing.

Consent and Privacy Notices: Where Most Small Businesses Slip

Two problems come up again and again.

Consent that does not count

Valid consent is freely given, specific, informed and unambiguous. Pre-ticked boxes do not qualify. Neither does a single checkbox covering the newsletter, partner offers and profiling all at once. On an online sign-up form, use unticked boxes, describe each use separately, and keep a record of what each person agreed to and when. Withdrawal must be as easy as signing up: a working unsubscribe link, not an email to a colleague who left last year.

Notices written for lawyers

Your privacy notice should answer five questions plainly: what you collect, why, who you share it with, how long you keep it, and how someone gets their data back or has it deleted. Write short sentences, put it where people actually look, and update it whenever your tools change. If a customer has to scroll through three screens of definitions to learn who receives their email address, it needs work.

Requests, Breaches and Suppliers

When someone asks for their data

People can ask to see, correct, delete or receive a copy of their data. You have one month to respond, extendable by two further months for genuinely complex requests. Write a short internal procedure: who logs the request, who verifies identity, who gathers the files, who replies. A saved reply template is worth the ten minutes it takes to draft. You generally cannot charge for this, and you cannot ignore a request just because it arrived through social media rather than email.

The 72-hour breach clock

A breach is any accidental or unlawful loss, alteration or disclosure of personal data — a stolen laptop, an email with the wrong attachment, an open folder. If it is likely to risk people's rights, you must notify your supervisory authority within 72 hours of becoming aware of it. Keep a one-page plan: who spots it, who assesses the risk, who contacts the authority, who informs affected individuals when the risk is high. Then run a short drill. The worst moment to invent a procedure is the morning after something goes wrong.

Your suppliers are part of your compliance

Payroll, hosting, email marketing, the accountant, the courier: each is a processor acting on your instructions. Article 28 requires a written contract covering what they may do with the data, the security they apply, how sub-processors are handled, and what happens to the data at the end. Check the agreements you already have and close the gaps. If data moves outside the EEA, identify the safeguard in place, such as an adequacy decision or standard contractual clauses.

Security, Retention and the DPO Question

Security does not require an enterprise budget. Give people access only to what they need. Turn on two-factor authentication for email and admin accounts. Encrypt laptops and phones. Set a rule against emailing spreadsheets of customer data. Apply software updates instead of postponing them.

Then decide retention: delete or anonymise data when the purpose ends, and put review dates in your map so deletion actually happens. Old data is pure liability — it stays on the risk side of the ledger and helps nobody.

Do you need a Data Protection Officer? For most small businesses, no. A DPO is mandatory for public authorities, for organisations whose core activities involve large-scale systematic monitoring, and for those processing special category or criminal

Photo: borevina / Pixabay