Cyber-Management
EN / FRbook a consultation

EU GDPR

GDPR compliance for SMBs: what to do first, and what can wait.

If you hold customer or staff data, GDPR applies. Here is where to start.

book a free 25-minute consultation

Does it apply to you?

It almost certainly applies. Here is where to start.

  • Do you hold data on customers, staff or contacts?Names, emails, payroll, a CRM. Then GDPR applies, whatever your size, including when you only sell to other businesses.
  • Do you handle personal data for your clients?As a software provider, agency, payroll bureau or IT provider. You are then their "processor", and contract and security duties apply to you.
  • Has a customer sent you a data protection questionnaire or contract?Larger customers check how you protect the data they share with you. A clear file answers them quickly.
  • Do you use sensitive data, track people or run AI on personal data?Health data, tracking, profiling. You may then need an impact assessment before you start, and possibly a data protection officer (DPO).

What changes for you

Know your data, protect it, and be ready to answer.

GDPR asks you to know what personal data you hold and why, keep it no longer than needed, protect it, and be able to show all this in writing. You must answer people’s requests about their data within a month. And you must report a data breach to the regulator within 72 hours, unless it is unlikely to put anyone at risk.

For a small company the real risk is usually a complaint, a lost customer or a failed customer audit, more than a fine. The fix is a short set of documents kept up to date: a record of what data you process, privacy notices, supplier contracts and a breach procedure.

What to do first

Start with a clear picture of your data.

What we deliver

  • A review of where you stand and what is missing, ranked by risk
  • Your record of processing: what data, why, for how long, who receives it
  • Privacy notices and a simple way to answer people’s requests
  • A breach procedure your team can follow within 72 hours
  • Contracts with the suppliers who handle data for you

Who does what

We lead the compliance work. Your IT provider keeps the technical side.

What we lead

  • Map your data and draft the record of processing
  • Write the notices, policies and breach procedure
  • Review your supplier contracts
  • Lead impact assessments where they are needed
  • Train staff and report to management

What stays with your IT provider

  • Set up access rights, backups and encryption
  • Apply the retention and deletion settings in your tools
  • Contain a breach and keep the logs

We check that the technical measures match what your documents promise.

How it starts

Your first step: a review of where you stand.

In about two weeks you know where you stand, what is missing and what to fix first. The rest of the work is sized to your company and your data, at a fixed fee.

Price
Fixed fee
Duration
About 2 weeks
Your time
2–4 short interviews

Fixed quote after the free call.

book a free 25-minute consultation

For your IT manager, DPO or CFO

Seven principles every processing activity must respect.
  1. 01Art. 5(1)(a)

    Lawfulness, fairness & transparency

    Processing must have a lawful basis, be fair to data subjects, and be transparent about how their data is used.

  2. 02Art. 5(1)(b)

    Purpose limitation

    Data collected for one purpose cannot be used for a different, incompatible purpose without a new lawful basis.

  3. 03Art. 5(1)(c)

    Data minimisation

    Only collect personal data that is adequate, relevant, and limited to what is necessary for the stated purpose.

  4. 04Art. 5(1)(d)

    Accuracy

    Personal data must be accurate and kept up to date. Inaccurate data must be erased or corrected without delay.

  5. 05Art. 5(1)(e)

    Storage limitation

    Personal data must not be kept longer than necessary. Documented retention schedules are mandatory.

  6. 06Art. 5(1)(f)

    Integrity & confidentiality

    Data must be protected against unauthorised access, loss, or destruction using appropriate technical and organisational measures (Article 32).

  7. 07Art. 5(2)

    Accountability

    Organisations must be able to demonstrate compliance — not just claim it. Documentation, policies, ROPA, and records are the evidence.

The headline numbers — and what actually triggers fines.

The headline maximum is €20 million or 4% of total worldwide annual turnover — whichever is higher — for the most serious violations (lawful basis, principles, data subject rights, international transfers). Lesser violations cap at €10 million or 2%. Failure to designate a DPO when required is an infringement in its own right — in the €10M / 2% band (Article 83(4)) — independent of any breach.

For SMBs the principles that drive the most enforcement are purpose limitation (using data beyond disclosed purposes), data minimisation (collecting more than needed), and storage limitation (retaining too long). The rights that drive the most complaints are access (Subject Access Requests) and erasure (right to be forgotten). And the lawful basis most challenged by authorities is legitimate interests.

  • Most serious breaches

    €20M / 4%

    whichever is higher, of total worldwide annual turnover.

  • Other breaches

    €10M / 2%

    whichever is higher — for procedural and DPO-designation failures.

  • Breach notification

    72 hours

    from awareness, to your supervisory authority's portal — CNIL in France, your Land authority in Germany, AP in the Netherlands, DPC in Ireland, etc.

Typical timeline

GDPR engagements run on the maturity of your starting point.

  1. 4–8 weeks

    Readiness sprint

    Gap analysis, ROPA, top-priority policy and notice work, breach process — enough to defend an inspection or satisfy a customer audit.

  2. 3–6 months

    Full compliance program

    Comprehensive policy library, all 8 data subject rights workflows, DPIA process, processor contracts, training, and ongoing review cadence.

FAQ

What IT managers and DPOs ask us about GDPR.

Who exactly does GDPR apply to?
In practice, anyone processing personal data of people in the EU. That includes businesses with EU customers or website visitors, every employer in the EU (HR, payroll, recruitment), B2B companies (CRM, email marketing and support all involve named people), and processors acting for others, such as SaaS providers, agencies, payroll bureaus and IT outsourcers, for whom Article 28 duties and data processing agreements apply. GDPR is Regulation (EU) 2016/679; supervisory authorities such as the CNIL, the German Land authorities, the AP, the DPC, the Garante and the AEPD assess compliance against its principles.
Does GDPR apply to my business if we are based outside the EU?
Yes if you offer goods or services to EU residents, or monitor their behaviour within the EU. Article 3 has extraterritorial reach. A US, UK, or Australian company with EU customers or website visitors whose behaviour it tracks is subject to GDPR — and may need to appoint an EU representative under Article 27.
What is a DPIA and when is it mandatory?
A Data Protection Impact Assessment identifies and reduces the privacy risks of a processing activity before it starts. Under Article 35 it is mandatory for processing likely to result in high risk to individuals, in particular systematic and extensive profiling, large-scale processing of special-category data (health, genetic, biometric, religious beliefs), and systematic monitoring of publicly accessible areas.
Do we need a Data Protection Officer (DPO)?
Article 37 makes a DPO mandatory for public authorities, organisations whose core activities involve large-scale systematic monitoring of individuals, and organisations that process special categories of data at scale. Even where not strictly mandatory, many SMBs appoint one voluntarily — either because clients require it, or because the role provides ongoing oversight that reduces violation risk.
What's the difference between a controller and a processor?
A controller decides why and how personal data is processed. A processor processes it on the controller’s behalf, following its instructions. Many SMBs are both: controller for their own staff and customer data, processor for their clients' data, with both sets of obligations.
How long can we keep personal data under GDPR?
There is no single prescribed retention period — it depends on the data, the purpose, and any legal obligations. Organisations must document their retention periods in a Retention Schedule and apply them consistently. Where a legal obligation requires longer retention than the original purpose would justify (e.g. tax records, employment law), the legal-obligation lawful basis governs.
What should we do if we suffer a personal data breach?
Five steps: (1) contain the breach and preserve evidence; (2) assess the risk to individuals; (3) if there is a risk, notify your supervisory authority within 72 hours of becoming aware — via your authority's portal (CNIL in France, your Land authority in Germany, AP in the Netherlands, DPC in Ireland, Garante in Italy, AEPD in Spain, etc.); (4) if the breach poses a high risk to individuals, notify them directly without undue delay; (5) document everything in your breach register under Article 33(5), including breaches you decide not to report.
How does GDPR apply to AI?
AI systems that process personal data fall under both GDPR and the EU AI Act, including the EDPB’s Opinion 28/2024 on AI models and personal data. The Article 35 DPIA fits with the AI Act’s Article 27 fundamental rights impact assessment, so one process can serve both. Our AI governance service covers this overlap.

Related

Often run alongside.

ISO 27001

Directly addresses GDPR Article 32 — the technical and organisational security measures GDPR requires.

Read more

ISO 27701

The certifiable privacy management standard, standalone since its 2025 edition: a recognised way to show customers how you manage personal data. It is not a GDPR certificate.

Read more

ISO 42001

For AI systems processing personal data: the AIMS standard structures the AI-specific governance that GDPR alone does not address — including EDPB Opinion 28/2024 considerations.

Read more

EU AI Act

Where personal data feeds AI, the AI Act layers on top of GDPR — the Article 27 FRIA integrates with the GDPR DPIA, and EDPB Opinion 28/2024 governs the intersection.

Read more

DPO as a Service

When Article 37 mandates a DPO and full-time hire is disproportionate to your scale.

Read more
back to compliance hub