A GDPR checklist for a small business should fit on a few pages and be answerable by the person who runs the business. The General Data Protection Regulation (Regulation (EU) 2016/679) asks you to know what personal data you hold, to have a lawful reason for each use, to tell people, to keep the data safe, to answer their requests and to report breaches. Below, each item gives the article behind it. This is general guidance, not legal advice, and some details differ by country, so check your own data protection authority's site.
1. Know what you hold
- List the personal data you collect: customers, prospects, staff, applicants, suppliers' contacts, website visitors. For each, note where it comes from, why you hold it, where it is kept, who sees it and when it is deleted.
- Keep this list as your record of processing activities (Article 30). Organisations under 250 employees have a limited exemption, but it falls away if processing is not occasional, risks people's rights or includes special category data such as health. A short table is usually easier than arguing about exemptions.
- Find the special category data (Article 9), which includes health, biometric data, religion and trade union membership. It needs an extra condition.
2. Have a lawful basis for each purpose
Article 6 gives six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. For each purpose in your list, pick one and write it down.
- A customer's address to deliver an order is contract.
- Keeping invoices for the tax period is legal obligation.
- A newsletter to people who ticked a box is consent, which must be freely given, specific, informed and as easy to withdraw as to give (Articles 4(11) and 7).
- A fraud check on your own shop may be legitimate interests, which needs a short written balancing of your interest against the person's.
Do not use consent when another basis fits. It can be withdrawn, and then you must stop.
3. Tell people clearly
Articles 13 and 14 list what a privacy notice must say: who you are and how to reach you, the purposes and bases, who receives the data, transfers outside the EEA and their safeguards, how long you keep it, the rights people have, the right to complain to an authority, and whether giving the data is required.
- Publish a notice in plain words where people give data (website, forms, shop). A website privacy notice is a starting point to adapt to your facts.
- Cookies and similar trackers also fall under the ePrivacy rules in each country, which usually require consent before non-essential ones load.
- Give staff and applicants their own notice.
4. Respect people's rights
People can ask for access (Article 15), correction (16), erasure (17), restriction (18), portability (20) and can object (21). The standard deadline is one month from the request, extendable by two months for complex or numerous requests, and you must tell the person if you extend (Article 12(3)).
- Decide who receives requests, how to check identity and where to look. A personal data access request and a deletion request template help keep the steps the same each time.
- Keep a log with the date received, the date answered and what you decided.
- Erasure is not absolute: you may keep what the law requires, such as invoices.
5. Choose processors carefully
Anyone who handles personal data on your behalf, such as a cloud host, email service, payroll provider or accountant, is a processor (Article 28).
- Have a written contract or data processing agreement with each one, covering instructions, confidentiality, security, sub-processors, help with requests, deletion or return at the end and audits. Use a data processing agreement where the provider has none.
- Keep a list of processors and review it yearly. See supplier audits for small companies.
- Check transfers outside the EEA (Chapter V). Look for an adequacy decision, standard contractual clauses or another valid tool, and see keeping your data in the EU.
6. Keep the data safe
Article 32 requires appropriate technical and organisational measures, considering risk and cost. For a small business that usually means:
- Unique accounts with a second factor on email, cloud storage and accounting.
- Updates applied promptly, and encrypted laptops and phones.
- Access only for people who need it, removed when they leave.
- Backups that you have tested by restoring.
- Staff who know not to send personal data to the wrong person or personal accounts.
Article 25 adds data protection by design and by default: collect only what you need and keep it only as long as you need it. Set a retention period for each item in your list, and delete on schedule.
7. Be ready for a breach
A personal data breach is a security incident that leads to accidental or unlawful destruction, loss, alteration, disclosure of or access to personal data (Article 4(12)). A lost unencrypted laptop or an email to the wrong list qualifies.
- Report to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk (Article 33). A late report must say why.
- If the risk is high, tell the people affected without undue delay, in clear words (Article 34). A notification template saves time under pressure.
- Record every breach, including those you do not report, with the facts, effects and action taken (Article 33(5)).
- Name who decides, and practise once. See incident reports and how to investigate.
8. Assess risky projects, and decide on a DPO
- Do a data protection impact assessment (Article 35) before processing that is likely to be high risk, such as large scale monitoring, large scale special category data or systematic profiling with serious effects. A privacy impact assessment gives the structure.
- Appoint a data protection officer only if Article 37 or national law requires it. Otherwise, name one person responsible and write it down.
- Train staff once a year and when they start, and keep the attendance.
A common small business example
A dental practice with eight staff keeps patient records (special category data), sends appointment reminders by text, and uses a cloud booking system and an outside payroll service. Its list has four lines. Patient care runs on contract plus the health-care condition in Article 9(2)(h). Reminders are covered by the contract if they are about the appointment itself, and need consent if they go further. The booking system and payroll provider each have a processor agreement. Staff have a short notice. The practice keeps a breach log, tests restores quarterly and answers access requests inside one month. None of this takes long once written down, and it is exactly what an inspector asks to see.
Evidence to keep
The processing list, the lawful basis for each purpose, current privacy notices, consent records where you rely on consent, processor contracts, the requests log, the breach log, impact assessments, training records and the date of the last review. When a data protection authority asks, you must be able to show how you comply (accountability, Articles 5(2) and 24).
Penalties are set by Article 83: up to 10 million euros or 2 percent of worldwide annual turnover for some infringements and up to 20 million euros or 4 percent for others, whichever is higher. Authorities consider size and effort, and in practice start with the most serious cases, but a business with nothing written down has little to show.
