GDPR Compliance for Small Businesses

Raise awareness among key people in your organization about the requirements of GDPR. Ensure that decision-makers and key people in your organization are aware that the law has changed, and understand the impact this is likely to have.

Document what personal data you hold, where it came from, who you share it with, and what you do with it. This may require an information audit.

Review your current privacy notices and put a plan in place for making any necessary changes in time for GDPR implementation.

Check your procedures to ensure they cover all the rights individuals have, including how you would delete personal data or provide data electronically in a commonly used format.

Update your procedures and plan how you will handle requests within the new timescales and provide any additional information required under GDPR.

Identify the legal basis for your processing activity in the GDPR, document it, and update your privacy notice to explain it.

Review how you seek, record, and manage consent and whether you need to make any changes. Refresh existing consents if they don’t meet the GDPR standard.

If your business processes children’s personal data, verify if you need to put systems in place to verify individuals’ ages and to gather parental or guardian consent for the data processing activity.

Make sure you have the right procedures in place to detect, report, and investigate a personal data breach.

Familiarize yourself with the guidance from the relevant regulatory authority and work out how to implement an impact assessment in your organization.

Designate a Data Protection Officer or someone to take responsibility for data protection compliance and assess where this role will sit within your organization’s structure and governance arrangements.

If your business operates in multiple EU member states, determine your lead data protection supervisory authority and document this.

Keep detailed records of all data processing activities, including the purpose of all activities, which will help you comply with the accountability principle of GDPR.

Regularly review your data protection processes and policies to ensure continual compliance with the GDPR regulations.

Provide your staff with GDPR training to make them aware of the importance of GDPR and to ensure they understand the compliance requirements.