The short version: GDPR compliance means handling personal data only on a legal ground the law allows, telling people how you use their data, reporting serious breaches fast and answering people's requests on time. The European Commission sets out the legal grounds and the 72-hour breach rule, and the European Data Protection Board's small business guide covers the one-month deadline for requests.
I've seen small business owners treat GDPR like a certificate you buy once and frame. It isn't. It's a handful of habits you keep up, and once you know what they are, it's far less scary. This is general information from the official EU pages, and those pages always govern.
The four habits behind GDPR compliance
Strip away the jargon and the European Commission's business pages boil down to four things. You need a lawful reason before you use someone's personal data. You need to tell people what you're doing with it. You need to report breaches quickly. And you need to answer people when they ask about their data. Everything else hangs off those.
A lawful reason, chosen from a fixed list
The Commission is blunt: a company can only process personal data in certain listed circumstances. Those are the person's consent, a contract with them, a legal obligation under EU or national law, a task carried out in the public interest, protecting someone's vital interests, and the company's legitimate interests.
Consent is only one option on that list. If someone buys from you, you can use their address to deliver the order because there's a contract. You don't need a consent tick box for that.
Telling people what you do
The Commission's obligations page says that when a company processes personal data, it must inform the people concerned and give them certain information about the processing. In practice, that's what your privacy notice is for. If yours is a copy-paste job from years ago, my guide to writing a privacy policy is a good place to start.
The rules side by side
| Obligation | What the EU body says | The detail people miss (as of Nov 2026) |
|---|---|---|
| Legal ground | European Commission: data can only be processed in listed circumstances, from consent to legitimate interests | Consent is one ground among several, not the default |
| Legitimate interests | European Commission: allowed only after checking the person's fundamental rights and freedoms aren't seriously impacted | You have to do the check before you rely on it |
| Telling people | European Commission: you must inform the people concerned and give certain information about the processing | Applies whenever you process their data, not only when you collect it by form |
| Breach to the authority | European Commission: at the latest within 72 hours of becoming aware of the breach | The clock starts when you become aware, not when you finish investigating |
| Breach to individuals | European Commission: people must be told if the breach poses a high risk to them | Not needed if effective protection measures were already applied to the data, or later steps make the risk unlikely |
| Requests from individuals | EDPB: answer at the latest within one month of receiving the request | Can be extended by two more months if the request is complex, as long as you tell the person within the first month |
The catch most owners miss
Legitimate interests looks like the easy option, and lots of businesses lean on it without thinking. The Commission's wording is the catch: you can rely on it only after you've checked that the fundamental rights and freedoms of the person aren't seriously impacted. That check comes first. If you've never written it down, you've skipped a step.
The same goes for breaches. The Commission's 72-hour limit runs from the moment you become aware of the breach. If you use a supplier who processes data for you, the Commission says that processor must notify every data breach to you, so make sure your contracts and your supplier know how to reach you quickly.
Five steps to get compliant this month
- List the personal data you hold: customers, subscribers, staff, leads, and where each list lives.
- Next to each one, write the legal ground you rely on from the Commission's list. If it's legitimate interests, write down your rights check too.
- Update your privacy notice so it tells people what you collect and why.
- Write a one-page breach plan with who decides, who reports, and how you'll hit the 72-hour limit.
- Set up a simple log for data requests with the date received, so the one-month deadline never sneaks up on you.
When someone asks for their data, or asks you to delete it
The EDPB's small business guide gives you at the latest one month from receiving a request to respond. If the request is too complex, you can take another two months, but only if you tell the person within that first month.
Requests to delete data are where people panic. The EDPB states clearly that the right to erasure isn't absolute. That doesn't mean you can ignore it; it means there are situations where you can keep data, and you should check before you either delete everything or refuse outright.
Tools are a big part of this now. If your team pastes customer details into AI apps, read my take on which AI tools fit GDPR for UK businesses, and if you run analytics, this piece on whether Google Analytics needs cookie consent is worth five minutes.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
What about UK businesses?
The UK runs its own version, UK GDPR, overseen by the Information Commissioner's Office. This page is built from the EU bodies' guidance, so if you only trade in the UK, check the ICO's own pages for anything UK-specific. Once the rules are clear, a look at consent tool alternatives to OneTrust shows what can handle the banner side.
My verdict
Don't buy a GDPR badge and don't panic. Pick a legal ground for every list you hold, keep your privacy notice honest, and have a breach plan and a request log ready before you need them. A small business that does those four things is in a far better place than most.
If you'd like your team's data handling built into the tools and workflows they already use, so the checks happen automatically, that's work I do. I run AI training and workshops for teams, and help businesses with AI enablement and workflow automation, so the busywork runs itself and people get time back. Most of that work is with SaaS marketing teams and small businesses. Here's how we can work together.
Frequently asked questions
What does GDPR compliance mean for a small business?
It means having a lawful reason for every use of personal data, telling people how you use it, reporting breaches on time and answering requests. Size doesn't change those core duties.
Do I always need consent to use personal data?
No. The European Commission lists consent as one legal ground alongside contract, legal obligation, public interest tasks, vital interests and legitimate interests.
How fast must I report a data breach?
The European Commission says at the latest within 72 hours after becoming aware of it, as of Nov 2026. People affected must also be told if the breach poses a high risk to them.
How long can I take to answer a data request?
The EDPB says at the latest within one month of receipt, extendable by two more months for complex requests if you tell the person within the first month.
Must I delete data whenever someone asks?
Not always. The EDPB notes the right to erasure isn't absolute, so check whether an exception applies before you act.
Does GDPR apply to a UK business after Brexit?
The UK has its own UK GDPR, overseen by the Information Commissioner's Office. If you also serve people in the EU, the EU rules covered here are the ones to read.
