GDPR for small businesses: the IT requirements you need

GDPR is not just a privacy page on your website. For a small company, most of compliance happens in IT: where the data lives, who can access it, how well it is protected, and what you do when something goes wrong. This is a practical guide, not legal advice — for the exact legal interpretation, talk to a specialized lawyer.

What GDPR actually requires from your IT

Beyond the legal text, GDPR translates into a few simple IT obligations: know what personal data you hold, where it is stored, who can access it and how long you keep it. A 20-person company keeping client data in emails, a spreadsheet on a laptop and an online CRM actually has three places to check, not one. You do not need elaborate procedures, you need clear answers to simple questions: who can see the client database, what happens to a CV once the candidate is not hired, how long you keep old invoices.

A record of processing: what data you have and where it lives

The first practical step is a simple list: what personal data you collect (clients, employees, candidates), which system holds it (CRM, accounting, email, shared folders) and who is responsible for each system. Without this record, you cannot properly answer a deletion request or an inspection.

• Client data — name, contact details, order history, usually in a CRM or invoicing tool.
• Employee data — contracts, salaries, reviews, usually in HR or accounting software.
• Candidate data — CVs received during hiring, often forgotten in inboxes for years.
• Marketing data — newsletter subscribers, website cookies, usually in the email platform or Google Analytics.

Who has access, and how you control it

The simple rule: each employee accesses only what their job requires, not everything. Your accountant does not need access to source code, and a sales rep does not need the payroll file. That means individual accounts, not one shared login for the whole team, unique passwords per person, and immediate access removal when someone leaves the company. A simple access log for critical systems — who logged in, when — helps you reconstruct quickly what happened if a suspicion ever comes up.

For external vendors who touch your data — accountant, marketing agency, developer — you need a data processing agreement (DPA) stating how they protect your data. Without one, you stay responsible for what they do.

Encryption, passwords, backup and deletion

Sensitive data — for example a client database — should be encrypted both at rest and in transit. Weak or shared passwords remain one of the most common causes of a breach; two-factor authentication (2FA) cuts that risk sharply, at almost no cost. Check employee mobile devices that touch company data too — a phone with no lock code, lost in a taxi, can be as serious as an unsecured server. Regular, periodically tested backups are mandatory — not just for GDPR, but so the company survives a ransomware attack or a failed drive. You also need a clear process to delete data you no longer have grounds to keep. See also backup and disaster recovery.

What to do within 72 hours of a breach

If you discover a data leak — a stolen laptop, a compromised account, a misdirected email with sensitive data — you have 72 hours to notify the supervisory authority, if the breach affects the rights of the people concerned. In practice you need a written plan ready in advance: who decides, who drafts the notification, how you isolate the affected system quickly. Document everything as you act — what you found, at what time, what measures you took — since this timeline matters both for the notification and for your own later protection. Without that plan prepared ahead of time, those 72 hours turn into panic, not coordinated action.

A cookie banner done right

A correct cookie banner does not just display text — it lets visitors refuse non-essential cookies as easily as they accept them. A large "Accept" button next to a tiny or hidden "Reject" one does not meet that bar. Analytics or marketing cookies should not fire before consent is given. Check periodically what cookies actually run on the site — new ones often show up, brought in by a plugin or an analytics script, without anyone explicitly approving them.

How to start

Start with a short data inventory and a security audit that shows exactly where you are exposed. For the exact legal reading of your obligations, dedicated GDPR consulting helps you avoid gaps. Contact us for an initial assessment.