GDPR Compliance for SMBs: The Practical Minimum

GDPR doesn't require a €10,000 project or a DPO for most small businesses. Here's what every SMB actually needs — based on what the Dutch DPA really checks for.

The GDPR applies to every business that processes personal data. For an SMB, that means: everyone. But it doesn't have to turn into a €10k consultancy engagement.

The eight things you need

1. Records of Processing Activities — what you process, why, and on what legal basis.
2. Data Processing Agreements (DPAs) with every supplier that handles data on your behalf.
3. Privacy statement on your website.
4. A procedure for handling data subject rights (access, rectification, erasure).
5. Cookie consent on your website.
6. A procedure for data breach notification (72-hour deadline).
7. Retention periods documented per data category.
8. Basic staff training covering phishing, passwords, and data sharing.

When do you need a DPO (Data Protection Officer)?

• Public authorities — always.
• Core activity is large-scale monitoring (CCTV operators, marketing trackers).
• Core activity involves processing "special category" data (healthcare, criminal records).

Most SMBs don't fall into any of these categories. If you do have an obligation, you can bring in an external DPO on an hourly basis.

DPIA: when is one required?

A DPIA is required for high-risk processing activities. For a typical SMB this is rarely the case, unless you work with health data, biometrics, or large-scale profiling.

Enforcement risk

Fines can reach 4% of global turnover. In practice: the Dutch DPA has become stricter with smaller SMBs since 2023. The most common findings are: no records of processing activities, missing DPAs, and overly broad cookie consent.

Overlap with ISO 27001

Already working on ISO 27001? Then 40% of your GDPR work is already done — and the reverse is equally true.