GDPR for small-team businesses: the complete guide, inside and outside the EU

GDPR, the EU’s data protection law, applies to small teams as it applies to large groups: a freelancer with a client list, a three-person agency and a shop with one employee all process personal data. It also reaches well beyond Europe. A company in London, Geneva, Montreal or Casablanca that sells to people in the EU, or tracks them with advertising cookies, has to follow it too.

For most small teams, compliance is a short list of concrete jobs rather than a legal project: know what data you hold and why, fix the legal pages of your website, sign the right contracts, answer people on time and react properly when something leaks.

Each section below answers one question and links to the article in my GDPR & privacy series that covers it in full.

Does GDPR apply to your business?

Size does not matter; where you are and whom you serve do. Article 3 sets two tests, establishment and targeting, which cover three situations:

1. You are established in the EU: an office, a branch or a stable local team, whatever its size, and wherever your servers are.
2. You offer goods or services to people in the EU from outside it, paid or free. A website people in the EU can merely open is not enough; prices in euros, delivery to EU countries or ads aimed at them are the signs that count.
3. You monitor the behaviour of people in the EU, for example with advertising cookies or retargeting.

A company outside the EU is usually caught by the targeting test, situations 2 and 3: my guide to the two tests works through both with six examples.

The UK and Switzerland have their own versions

Since Brexit, the UK applies the UK GDPR, a near copy of the EU text, together with the Data Protection Act 2018 and PECR, the rules on cookies and marketing emails. It uses the same tests for companies outside the UK, so a French company selling to UK customers answers to both laws. Data still flows freely from the EU to the UK: the EU renewed its adequacy decisions for the UK in December 2025, until 27 December 2031.

Switzerland has its own law, the revised Federal Act on Data Protection (FADP), in force since 1 September 2023. It applies to anything that has an effect in Switzerland, even when it starts abroad, which is broader wording than the GDPR’s.

Your home country’s law still applies

The GDPR adds to your local rules; it does not replace them. A Moroccan company selling to customers in France answers to Morocco’s Law 09-08 and its regulator, the CNDP, at home, and to the GDPR for its French customers. The same goes for a Canadian, American or Tunisian business under its own law.

Find your path

The seven principles and six legal bases, in plain words

Everything else in the GDPR follows from the seven principles of Article 5:

• Lawfulness, fairness and transparency: a legal basis for each use, and people told what you do.
• Purpose limitation: data collected for one purpose is not reused for an unrelated one; a quote request is not a mailing list.
• Data minimisation: only what the purpose needs.
• Accuracy: errors corrected, records kept up to date.
• Storage limitation: data deleted or anonymised when the purpose ends.
• Integrity and confidentiality: protection against loss, theft and leaks.
• Accountability: you can prove all of the above, which is why the paperwork matters.

Article 6 then lists six legal bases. Every use of personal data needs one, chosen before you start and named in your privacy policy:

Consent is the basis people think of first, but for a small team it is usually the narrowest: most client data rests on the contract, the law or legitimate interests. In the UK, the Data (Use and Access) Act 2025 added “recognised legitimate interests”, a short list of purposes that skip the balancing test.

Step 1: map your data in a record of processing

Every other step depends on knowing what you hold. Article 30 asks for a record of processing activities: one line per activity (client management, invoicing, newsletter, recruitment, website forms) with its purpose, the people and data concerned, who receives the data, whether it leaves the EU, how long you keep it and how you protect it.

Organisations with fewer than 250 employees are exempt only for processing that is occasional, unlikely to put anyone at risk and free of sensitive or criminal-offence data. Managing clients and invoices is not occasional, so in practice most small teams keep a record, even a short one. The CNIL has published a simplified template in French, the ICO offers two basic templates on its page on documenting processing activities, and a spreadsheet does the job as well.

Note your role on each line. You are the controller when you decide why and how data is used (your own client list), and a processor when you handle it on someone else’s instructions (an agency running a client’s newsletter). The role decides which contracts you need in step 3.

An EU simplification package proposed in May 2025, “Omnibus IV” (procedure 2025/0130(COD), not the Digital Omnibus below), would widen the 250-employee exemption: the Commission proposed a threshold of 750 employees and a record only for high-risk processing. The Parliament and the Council reached a provisional agreement in June 2026, but as of 19 October 2026 it has not been formally adopted, so the 250 rule still applies.

Step 2: fix your cookie banner, privacy policy and legal notice

Start with the cookie banner. In the EU, any cookie or tracker that is not strictly necessary needs the visitor’s consent before it is set, and refusing must be as easy as accepting. France’s CNIL expects a “Refuse all” button as visible as “Accept all”; in January 2022 it announced fines of €150 million on Google and €60 million on Facebook because refusing cookies was harder than accepting them. In the UK, since February 2026, analytics used only for statistics can run without consent if you explain it and offer an easy way to object; advertising cookies still need consent. The rules are in what cookie banners must do in 2026, and the set-up on Squarespace, Wix and WordPress, with Google’s Consent Mode v2, in my cookie banner tutorial.

Next comes the privacy policy. Articles 13 and 14 list what people must be told: who you are, why you collect their data and on which legal basis, who receives it (your tools included), how long you keep it and what rights they have, including the right to complain to a regulator. What a privacy policy must say takes it section by section, starting from your real tools rather than a copied template.

Then the legal notice. It is not a GDPR requirement, but it belongs on the same to-do list: a business website must say who runs it. France asks for the most, on a page called the mentions légales, and website legal notice requirements covers France, the rest of the EU and the UK.

If you publish a mobile app, the stores add their own declarations: Apple’s privacy labels and Google Play’s Data safety form describe your data, but your advertising SDKs, and most analytics SDKs, still need consent before they read or store anything on the phone.

The banner and these pages are part of the websites I build, if you would rather hand that side over.

Step 3: sign processor contracts and check where data goes

Almost every tool you use handles personal data for you: email, CRM, accounting software, website host, newsletter tool, and the freelancer who updates your site. Each one is a processor, and Article 28 requires a contract with it that covers, among other things, your instructions, security, sub-processors and deletion at the end. Large providers build this data processing agreement into their terms. For smaller suppliers, the EU’s free standard clauses (Commission Implementing Decision 2021/915) are a ready-made starting point.

It works the other way round too. When I build an automation that needs access to a client’s mailbox, I handle their data on their behalf, which is exactly the relationship Article 28 is written for. When you need a data processing agreement covers both sides.

Then check where the data goes. Personal data can leave the EU only on a legal footing set by Chapter V of the GDPR: an adequacy decision for the destination, which the UK, Switzerland and Canada (for businesses covered by PIPEDA, its federal private-sector law) have, or safeguards such as the standard contractual clauses. For US tools, the EU-US Data Privacy Framework has applied since 10 July 2023 to companies listed as active on dataprivacyframework.gov. As of 19 October 2026, an appeal against it is pending before the EU Court of Justice, so keep the clauses in your providers’ agreements as a fallback; using Google, Microsoft and Mailchimp under GDPR explains how.

The same rules reach suppliers outside the EU. A call centre in Morocco or a developer in Tunisia working on a French client’s customer data is that client’s processor, and since neither country has an adequacy decision, the transfer usually rests on the standard contractual clauses, signed alongside the processing contract.

Step 4: answer people’s requests within one month

People have rights over their data: access, rectification, erasure, restriction, portability, objection and protection from purely automated decisions (Articles 15 to 22). Article 12 gives you one month to answer, extendable by two further months for complex or numerous requests if you tell the person within the first month. The best known is the subject access request, which often arrives in the middle of a dispute with a customer or a former employee: how to answer a subject access request walks you through it.

Two rules small teams often miss. An objection to direct marketing is absolute (Article 21(3)), so the address goes on a suppression list at once. And in the UK, since 19 June 2026, you must accept data protection complaints yourself, for example through an online form, and acknowledge them within 30 days.

Step 5: secure the data and know the 72-hour rule

Article 32 asks for security appropriate to the risk. For a small team, that mostly means a few habits: a password manager and two-factor authentication on every account, backups you have restored at least once, updated devices, and access removed the day someone leaves. My cybersecurity guide covers them in order, with a one-page plan for the first hour of an incident.

If personal data is lost, stolen, leaked or locked by ransomware, Article 33 gives you 72 hours from the moment you become aware of it to notify your regulator (the CNIL, the ICO or the authority of your EU country), unless the breach is unlikely to put anyone at risk. When the risk to people is high, you tell them as well (Article 34), and every breach, notified or not, goes into an internal record. Two of my clients called me in an emergency after their old website had been hacked; when a hacked site holds form messages or customer accounts, that 72-hour clock may already be running. What to do in the first 72 hours gives the steps.

Step 6: set retention periods for your CRM

The GDPR sets no fixed periods: you keep personal data as long as its purpose requires, and you must be able to justify the period you chose. Regulators give benchmarks. In France, the CNIL’s reference is three years from collection or from the last contact coming from a prospect, and three years after the end of a client relationship for marketing, while invoices are kept ten years under the Commercial Code. In the UK you set your own periods, anchored on rules such as HMRC’s six years for company records.

Write your periods in a short table, then set your CRM and mailbox to delete or archive on schedule; GDPR retention periods for your CRM gives the periods to start from.

Step 7: email marketing, cold emailing and AI tools

Newsletters to individuals need consent in the EU and the UK: a box they tick or a form they submit themselves, recorded with the date and the wording shown. The soft opt-in lets you email existing customers about your own similar products, if they could refuse when you collected their address and can opt out in every email. Double opt-in is not required by the GDPR, but it is the best proof of consent you can keep: see newsletter consent explained.

B2B prospecting brings up an objection I hear from clients: that cold emailing is illegal. In B2B it is not, as long as you follow the rules of the country you send to. In France, you can email professionals without prior consent when the message relates to their job, they are told how their address will be used and they can object simply and for free. In the UK, PECR lets you email limited companies and LLPs without consent, but sole traders and partnerships outside Scotland need it. In both, when the address names a person, the GDPR adds a documented legitimate interest, privacy information in the first email at the latest and opt-outs honoured at once. My cold email compliance checklist goes through each point.

One newer rule: in a recommendation published in April 2026, the CNIL treats open-tracking pixels in marketing emails like cookies, so they need the recipient’s consent, B2B included, apart from narrow exemptions.

AI assistants are the newest place where client data ends up. Anonymised text is fine in any ChatGPT plan with training switched off; clients’ names, emails and other personal data belong only on a business plan or the API, under a data processing agreement, and health data, ID numbers, bank details and passwords stay out altogether. Details in ChatGPT and GDPR.

Do you need a DPO or a representative?

Under the GDPR, a data protection officer (DPO) is mandatory in three cases only (Article 37), though national law can add others: public bodies, organisations whose core activity involves regular and systematic monitoring of people on a large scale, and organisations whose core activity is large-scale processing of sensitive data, such as health data, or of data on criminal convictions. A small team rarely qualifies: Recital 91 says an individual doctor or lawyer handling patients’ or clients’ data is not processing on a large scale. If you appoint a DPO voluntarily, the same rules on independence apply, so a named “privacy contact” is often the simpler choice.

A representative is a different role (Article 27). A business with no establishment in the EU that sells to or monitors people there must designate one in writing, in an EU country where those people are, unless its processing is occasional, low-risk and free of large-scale sensitive data. The Dutch regulator fined Locatefamily.com €525,000 for not having one, in a decision announced in May 2021. The UK GDPR has the same rule for companies outside the UK, EU businesses included, and as of 19 October 2026 the 2025 Act has not removed it. Switzerland asks for one only when processing data on people there is large-scale, regular and high-risk at once. Who needs an EU representative, and how to appoint one has the details.

What a GDPR fine really looks like for a small team

The figures in headlines are ceilings: up to €10 million or 2% of worldwide annual turnover for some breaches and €20 million or 4% for the most serious (Article 83), whichever is higher, and £17.5 million or 4% under the UK GDPR. Regulators scale fines to the size and finances of the business.

Since 2022, France’s CNIL has handled simple cases through a simplified procedure capped at €20,000, and these decisions are not published; in 2025, 67 of its 83 sanctions went through it. Published cases against small organisations include €3,000 for a doctor in private practice and €20,000 for a translation company with nine employees. In the UK, a pharmacy’s £275,000 fine was cut to £92,000 on appeal. Each case started with a complaint, an inspection or a report from another authority.

For a small team, a complaint more often ends in a formal notice to comply than in a fine. What a small-team business really risks goes through the cases.

What is changing: the Digital Omnibus and the UK’s 2025 Act

In the EU, the Digital Omnibus is a European Commission proposal of 19 November 2025 that would amend the GDPR and the cookie rules: a narrower test of what counts as personal data, cookie refusal in one click, legitimate interest as a basis for developing AI, and breach notification within 96 hours, only when the risk is high. As of 19 October 2026 it is still a proposal: EU governments have no negotiating position yet (a vote planned for October was postponed) and the European Parliament is at committee stage. Until it is adopted, today’s rules apply, the 72-hour deadline included. What the Digital Omnibus could change follows it.

In the UK, the Data (Use and Access) Act 2025 amends the UK GDPR, the Data Protection Act 2018 and PECR rather than replacing them. Most of its data protection changes have applied since 5 February 2026, including the analytics exemption and PECR fines of up to £17.5 million or 4% of worldwide turnover; the complaints duty followed on 19 June 2026. On 30 September 2026, the ICO became the Information Commission, though it is still known as the ICO. What changed in UK GDPR lists the rest.

Where to start this month, and when to call a lawyer

If you do nothing else this month, do these seven things, in this order:

1. List your processing activities and your tools in a spreadsheet (step 1).
2. Open your website in a private window: nothing but essential cookies should load before you choose, and “Refuse all” should be as easy as “Accept all” (step 2).
3. Bring your privacy policy and legal notice in line with that list (step 2).
4. Check that each tool’s data processing agreement is in place, and have your freelancers sign one (step 3).
5. Write a one-page procedure for access requests and breaches: who does what, and the deadlines (steps 4 and 5).
6. Set retention periods and the matching clean-up in your CRM (step 6).
7. Review your marketing lists: consent for individuals, opt-outs honoured for everyone (step 7).

For the official version, the EDPB’s SME data protection guide covers the same ground for EU businesses, and the GDPR itself on EUR-Lex settles any doubt about an article.

This guide explains the rules and the official guidance; it is not legal advice. A lawyer or a DPO is worth paying for when you handle health or other sensitive data, monitor people on a large scale, sell a product built on personal data, receive a letter from a regulator or a claim from a customer, or suffer a serious breach, ideally alongside a certified incident response provider for the technical side.