Does GDPR Apply to Your Business?

Short answer: probably yes. GDPR applies if you:

Are based in the EU/EEA
Have customers, users, or website visitors from the EU
Process personal data of EU residents in any way

If your website uses Google Analytics and gets traffic from Europe, GDPR applies to you. It doesn't matter where your company is headquartered.

The Practical Checklist

Here's what you actually need to do, prioritized by impact and risk:

✅ Priority 1: The Essentials (Do These First)

1. Publish a Privacy Policy

You need a clear, accessible privacy policy that explains what data you collect, why, and how users can exercise their rights. Generate one for free with LegalKit.

2. Get Proper Cookie Consent

That cookie banner isn't just annoying UX — it's legally required. You need:

A banner that appears before non-essential cookies load
Clear options to accept or reject
Granular control (analytics vs. marketing vs. functional)
No pre-checked boxes
The ability to withdraw consent later

3. Implement a Lawful Basis for Processing

Every piece of data you collect needs a legal justification:

Consent — user actively agreed (opt-in forms, cookie consent)
Contract — needed to deliver your service (shipping address for orders)
Legitimate interest — reasonable business use (fraud prevention, analytics)
Legal obligation — required by law (tax records)

4. Respond to Data Subject Requests

Users can ask to: access their data, delete it, correct it, export it, or restrict processing. You have 30 days to respond. Set up a process now.

✅ Priority 2: Important Safeguards

5. Minimize Data Collection

Only collect what you actually need. Don't ask for a phone number if email works. Don't track users across your site if a page view count suffices.

6. Secure the Data You Have

Encrypt data at rest and in transit (HTTPS, encrypted databases)
Use strong access controls (not everyone needs access to everything)
Keep software updated
Use strong passwords and 2FA for admin accounts

7. Document Your Data Processing

Maintain a record of what data you process, why, where it's stored, and who has access. This is your "Record of Processing Activities" (ROPA). It can be a spreadsheet.

8. Review Third-Party Services

Every tool you use that touches user data needs a Data Processing Agreement (DPA). Most major services (Stripe, AWS, Google) offer standard DPAs. Make sure you've signed them.

✅ Priority 3: Good Practices

9. Implement Data Retention Policies

Don't keep data forever. Define how long you keep each type of data and set up automatic deletion where possible.

10. Plan for Data Breaches

Under GDPR, you must notify your supervisory authority within 72 hours of discovering a breach. Have a plan:

Who's responsible for breach response?
How will you assess the scope?
Template notification ready to go

11. Train Your Team

Everyone who handles personal data should understand the basics. This doesn't need to be a 40-hour course — a 30-minute overview covers most small teams.

12. Appoint a DPO (If Required)

You need a Data Protection Officer if you:

Are a public authority
Do large-scale systematic monitoring
Process sensitive data at scale

Most small businesses don't need one, but designating a privacy point-of-contact is still smart.

What You Can Probably Skip

Small businesses don't need to:

Hire a dedicated DPO (unless you meet the criteria above)
Get certified under any specific framework
Conduct formal Data Protection Impact Assessments (unless processing high-risk data)
Register with every EU supervisory authority

The Cost of Non-Compliance

GDPR fines come in two tiers:

Up to €10 million (or 2% revenue) for administrative violations
Up to €20 million (or 4% revenue) for core violations

Small businesses rarely face maximum fines, but enforcement is real. In 2025 alone, hundreds of SMBs received fines ranging from €5,000 to €500,000.

Get Started in 5 Minutes

The fastest way to check off item #1 on this list:

Generate your GDPR-compliant privacy policy →

LegalKit asks about your specific data practices and generates a customized document that covers the GDPR requirements relevant to your business.

*This guide is for informational purposes only and does not constitute legal advice. For complex compliance questions, consult a qualified attorney.*

GDPR Compliance Checklist for Small Businesses (2026 Guide)