GDPR for small businesses: duties that still apply

Does GDPR for small businesses and SMEs mean fewer duties?

The GDPR eases only a narrow set of duties for organizations with fewer than 250 employees, mainly the record of processing under Article 30(5). Security of processing, rights handling, breach response and processor contracts apply in full regardless of size. A customer or contract asking for GDPR evidence is asking for the second group, and the small-company exemption does not change what that customer can require. The exemption also has conditions. It falls away where processing is likely to result in a risk, is not occasional, or includes special category or criminal offence data. The EDPB's small business guide reads the exemption the same way, noting that only purely occasional activities can be left out of the record.

Whether the exemption helps you therefore depends on your processing, not your headcount. A small firm that occasionally sends invoices to a handful of clients may have little to record. A small clinic, a recruitment agency or a company running monitoring through a mobile app may not qualify, even with few staff. Confirm each processing activity against those three conditions before you rely on the exemption, and write down why you concluded it applies. Also check the Omnibus IV proposal, which would raise the threshold to fewer than 750 employees with a high-risk condition. A text was agreed on 26 June 2026 and awaits Parliament's first-reading vote, so it is not yet law and should not shape current decisions.

The organization owns every control, whatever its size, and must be able to show how each one works. Its systems need authentication before access, a backup and restore policy, rights request procedures that answer within one month, and a written processor contract wherever a vendor handles personal data. The EDPB's guide for small business treats some of these as minimum measures for any organization. Start by listing your systems, vendors and personal data flows, then assign an owner to each control and keep dated records of the checks you run. Those records are the evidence a customer audit or a supervisory authority inquiry will ask to see.

Which GDPR duties scale down for small companies and which do not

Size changes how much paperwork the GDPR asks of a small company, but it does not change who is accountable. Of the six duties below, only the record of processing has a size-based exemption, and even that depends on the kind of processing. The rest apply in full, with the measures and documentation scaled to the risk of each activity.

Record of processing

Article 30(5) exempts organizations with fewer than 250 employees, but only if processing is not likely to result in a risk, is occasional, and does not include special category or criminal offence data. The EDPB's small business guide says such organizations need not record purely occasional activities. Check whether your payroll, customer accounts or any health or biometric data push you outside the exemption. Confirm your headcount and processing list before relying on it.

Security of processing

Article 32 applies to every controller regardless of size. Measures must fit the risk of the processing, but the duty to have them does not scale down. The EDPB's guide lists minimum measures for any organization, including requiring users to authenticate before using computer facilities and keeping a backup and retrieval policy for incidents. Review whether those measures still work as systems change.

Rights requests

Access, erasure and the other rights apply in full to small organizations. The EDPB expects a small business to be ready with trained staff, make rights easy to exercise, keep an up-to-date data register, answer within one month, pass results to recipients, and document requests and refusals. Check that your systems can find a person's data across tools, including backups and logs, before a request arrives.

Processor contracts

A controller-processor contract is obligatory whenever you use an outside provider to handle personal data, such as a payroll bureau, hosting company or cloud tool. The EDPB notes that infringing this carries fines of up to EUR 10 million or 2% of total annual turnover. Templates have been published by the Danish and Slovenian authorities and the European Commission. Check that every supplier handling your data has a signed agreement.

Breach notification

Any personal data breach that is likely to risk individuals' rights must be notified to the supervisory authority within 72 hours of becoming aware of it. Size does not extend this clock. Small organizations often lack a detection route or a named person to decide on notification, so write one before an incident. Confirm who receives vendor breach notices and how quickly they reach you.

Data protection impact assessments

A DPIA should usually be carried out where processing meets two of nine high-risk criteria listed in the EDPB's guide. The written assessment must describe the processing, assess necessity and proportionality, identify risks and list mitigation measures. The EDPB's examples of large-scale monitoring, such as geolocation through a mobile app or CCTV in public spaces, show when this duty is likely to apply. Screen new projects against the nine criteria before launch.

How the 250-employee record-keeping exemption works in practice

The 250-employee record-keeping exemption in Article 30(5) relieves organizations with fewer than 250 employees from keeping a record of processing activities, but only while none of three conditions applies: the processing is likely to result in a risk, the processing is not occasional, or it includes special category or criminal offence data. The exemption is narrower than its headline suggests. The EDPB's guide for small business notes that purely occasional activities need not be recorded, which leaves most ongoing operations inside the duty. Before relying on it, a company should list its processing activities and test each one against those three conditions, because a single non-occasional activity removes the exemption for the whole organization.

In practice, a small company with a payroll, a customer account database, a website contact form that feeds a CRM, or any form of monitoring usually cannot rely on the exemption. Payroll is recurring, so it is not occasional, and it typically includes national identifiers and bank details that carry risk. Customer accounts are ongoing processing by definition. Illustrative example: a 40-person online retailer that keeps customer orders, a loyalty scheme and a staff rota system would need to test each of those three activities separately, and the loyalty scheme alone would likely take the company outside the exemption. The reader should document that test and keep it with the rest of the GDPR evidence.

The threshold may change. Omnibus IV would raise the record-keeping exemption to organizations with fewer than 750 employees unless processing is likely to be high risk. A text was agreed in interinstitutional negotiations on 26 June 2026 and awaits Parliament's first-reading vote, which is indicatively scheduled for 23 November 2026. The GDPR text had not been amended as of October 2026, so the 250-employee threshold still applies today. Organizations should plan against the current text, and should confirm the status of the vote on the European Parliament Legislative Observatory) before changing any internal record-keeping decision, since a proposal is not law until it is adopted and published.

What GDPR work costs a small business and who gets paid

This table compares each cost component of GDPR work for a small business, who is paid for it, whether it is one-time or recurring, and what moves it up or down. Read it as a checklist for building a quote request, since the GDPR requires no audit or certificate and so no mandatory auditor fee. The main takeaway is that most cost is internal staff time, and the external spend you control is mainly scoped advice, templates and tooling.

Cost component	Who is paid	One-time or recurring, and what drives it
Internal staff time (owner or manager)	Your own staff, no external payment	Recurring. Grows with headcount, number of data flows and how often rights requests arrive.
Person who runs rights requests	Your own staff, or a trained colleague covering the role	Recurring. Driven by request volume and how easily systems let you find and export data.
External DPO where one is required	An external DPO service provider	Recurring where the role is mandatory. Driven by the processing type, such as large-scale regular monitoring, and by the hours agreed.
Processor contract and template review	Your lawyer or adviser, or no one if you use a published template	One-time per supplier, plus updates when suppliers change. Driven by how many processors you use and how much negotiation is needed.
Records, access and logging tools	Software vendor or managed service provider	Usually recurring subscription or hosting. Driven by user count, retention needs and whether you self-host.
Backup and restore	Storage provider, or your IT contractor for setup and restore tests	Recurring storage plus occasional testing. Driven by data volume and how often you test restores.
Security baseline review or implementation partner	Independent security consultant or implementation partner for systems and evidence	Usually one-time for the review, then periodic. Driven by how many systems hold personal data and how complete your existing records are. Ask for a fixed-scope written quote.
Trade association codes of conduct	Trade association membership fee, where one applies	Recurring membership, if the association offers a code. Ask whether the code covers security measures and transfer procedures.

In what order a small company should put GDPR controls in place

The sequence moves from knowing what personal data the company holds, to protecting it, to agreeing responsibilities with suppliers and handling individuals' requests, and ends with the DPIA and DPO decisions. Each phase produces a document or record that a customer, a complaint or a supervisory authority could ask to see.

Map personal data and data flows
Start by listing every system, spreadsheet, device and service where personal data sits, including customer records, staff files, website forms and backups. For each one, note what data is held, why, who can access it, where it is stored and which outside companies receive it. Keep this in an up-to-date register, because the EDPB's guide for small business expects you to know your data flows before you can meet other duties. The step is complete when the register covers every data flow and someone in the company has signed off on it. A partner can help build the technical inventory, but the business owner remains responsible for the accuracy of the register.
Decide which processing needs a record
Using the register, check each processing activity against the Article 30(5) exemption for organizations with fewer than 250 employees. The exemption does not apply where processing is likely to result in a risk, is not occasional, or includes special category or criminal offence data. Record the decision for each activity, including the reasoning, so that you can show why an activity was or was not documented. Even where the exemption applies, keeping a simple record is usually the easiest way to answer later questions. Note that the Omnibus IV proposal would change this threshold, so confirm the current position before relying on it. The company owns this decision, and the output is a short written determination for each activity.
Set the minimum security baseline
Apply the minimum measures the EDPB's guide for small business lists for any organization, starting with requiring users to authenticate before they access computer facilities. Confirm that every account is individually assigned, that shared logins are removed where possible, and that devices and cloud services are protected. Then write and test a data backup and retrieval policy that states what is backed up, how often, where copies are kept and how data is restored after an incident. The step is complete when the measures are configured, the backup has been restored at least once as a test, and the settings are written down. Guidance from the EDPB also says these measures must be reviewed regularly for effectiveness, so schedule that review in the company's calendar.
Sign processor contracts with each supplier
Work through the supplier list from the register and identify every company that processes personal data on your behalf, such as hosting, payroll, email, accounting and support providers. Put a controller-processor contract in place with each one, since the EDPB's guide says this contract is obligatory. Use a template where one is available, such as those published by the Danish and Slovenian authorities or the European Commission, and check that the terms cover instructions, confidentiality, security, sub-processors and breach notice. Keep a file with each signed agreement. The output is a complete contract file matched against the supplier list, and the company should confirm each supplier's sub-processors before signing.
Set up the rights request process
Build a simple process for access, rectification, erasure and other requests, guided by the seven practices in the EDPB's guide. Assign a named person, prepare a template for responses, and make sure staff know how to recognize a request and where to send it. Confirm that your systems can find a person's data across the register, and that you can pass corrections or erasures on to recipients. The guide sets a one-month target for answers, so the process should show how each request is tracked against that date. Keep a log of every request, the answer, and the reasons for any refusal. The step is complete when a test request has been run through the process from intake to logged response.
Run a written DPIA where two high-risk criteria apply
Check each processing activity against the nine high-risk criteria listed in the EDPB's guide. Where two or more apply, the guide says a DPIA should usually be carried out. The written assessment must describe the processing, assess necessity and proportionality, identify the risks to individuals and list the measures that reduce them. Record the date, the people involved and any review points. Where a DPIA is not needed, keep a short note explaining the screening result. The output is either a completed DPIA for each affected activity or a documented screening decision. The business owner signs the assessment, and a partner can help structure the security risk analysis that feeds it.
Record the data protection officer decision
Decide whether a data protection officer is mandatory by checking the core activities of the business. The EDPB's guide gives large-scale regular and systematic monitoring, such as geolocation through a mobile app or CCTV of public spaces, as examples that make a DPO mandatory. If none of the mandatory triggers apply, you may still appoint a DPO voluntarily, but the role then carries the same expectations of independence and resources. Record the decision, the reasons and the date in writing, and review it when the business changes its activities. Where an external DPO is used, confirm the scope, the tasks and the contact details in the contract. The output is a signed decision record that the company can show to a customer or regulator.

Which minimum security measures every organization should be able to show

The GDPR does not scale security down for small companies. The EDPB's small business guide names baseline measures that apply to any organization, and Article 32 requires them to be appropriate to the risk. Each card below names a measure, the evidence that shows it exists, and what your organization must confirm in its own environment.

User authentication before access

Every account that can reach personal data should require the user to authenticate first, with unique credentials per person and no shared logins. Evidence is an account list tied to named people, a configuration export showing that authentication is enforced on the systems that hold customer or employee data, and a record of who approved each account. Confirm that laptops, cloud consoles, email and any shared file stores are covered, since small teams often miss one of them.

Data backup and retrieval policy

A written policy should state what personal data is backed up, how often, where copies are kept, who may restore them and how a restore is tested after an incident such as ransomware or accidental deletion. The evidence that matters most is a dated restore test record showing that the data came back, not only that a backup job reported success. Confirm that backups are protected by the same access controls as the source system and that they are included in your erasure process, because deleted records can otherwise reappear.

Access limited to people who need it

Staff should see only the personal data their role requires. Keep a current access list for each system that holds personal data, remove access when someone leaves or changes role, and review it on a fixed schedule. Evidence is the access list itself, a leaver checklist with completion dates, and the approval trail for elevated rights. Confirm who holds administrator rights, because in a small company that is often one or two people with access to everything.

Up-to-date software and patching

Operating systems, browsers, applications and network devices that process personal data should receive security updates within a defined period. A simple patch log that records the system, the update, the date applied and any exception is usually enough to show the measure works. Confirm which systems are self-managed and which are covered by a vendor, because a SaaS tool that patches itself still needs to be listed in your records. Unsupported software with no planned replacement is a finding regulators can cite.

Logging of access to personal data

Systems holding personal data should record logins, privileged actions and exports so that unusual access can be detected and investigated. Evidence includes a log configuration showing which events are captured, a retention setting for those logs, and a record of periodic log reviews or alerts that were acted on. Confirm that logs are stored where the people administering the system cannot quietly alter them, and that you can search them quickly enough to meet the 72-hour window for a breach assessment.

Periodic review of measures

EDPB Guidelines 4/2019 require controllers to review regularly whether the chosen measures and safeguards still work, and this applies to older systems that predate the GDPR. Keep a dated review record that lists each measure, the result of testing it, any gap found and the action taken. A short annual review by the person responsible for data protection is a workable starting point. Confirm the review date and owner for your organization, and retain the record so you can show a regulator how the measures changed over time.

When a DPO is still mandatory and when a DPIA is expected

A small company does not escape the data protection officer duty by being small. Under Articles 37 to 39, a DPO must be designated when the core activities of the controller or processor consist of processing operations requiring regular and systematic monitoring of individuals on a large scale, or of large-scale processing of special category or criminal offence data. The test turns on what the business does with personal data and how much of it, not on headcount. The EDPB's guide for small business gives geolocation through a mobile app and CCTV covering shopping centres or public spaces as examples of large-scale regular and systematic monitoring that makes a DPO mandatory. A company with a handful of staff that runs a location-tracking app for thousands of users may therefore need one. Check your core activities against those articles before assuming the answer is no.

The EDPB guide states that a DPIA should usually be carried out where processing meets two of nine listed high-risk criteria. Treat that as a practical trigger to screen each new system or data flow, then record the result. Where a DPIA is required, the written assessment must describe the processing, assess necessity and proportionality, identify risks to individuals and list the mitigation measures. For a small team, the most useful outputs are a clear data flow description, the reasons the data is needed, and a table of risks matched to controls such as access restriction, encryption and retention limits. Review the DPIA when the processing changes, not only once at launch.

If a DPO is required, the role must be independent, supported with adequate resources and free of conflicts of interest, such as a position that would have the person deciding the purposes of processing. Many small companies meet this by appointing an external DPO service. That arrangement is a contract for a person or firm to perform the Article 39 tasks, and the buyer should confirm the scope, reporting line, time commitment and conflict checks in writing. An outside DPO does not provide a certificate or confer compliance on its own, and the controller remains responsible. Ask any provider which of the Article 39 tasks it covers, who performs them and how the company will document its decisions.

Who does what: the business, an implementation partner and the regulator

The business owner or manager remains accountable for GDPR compliance, whatever tools or partners it uses. The controller is the organization that decides why and how personal data is processed, so the duties of Article 24 and the principles of Article 5 rest with the business, not with a vendor or consultant. Decisions on lawful basis, the acceptable level of risk and whether a processing activity goes ahead belong to management.

Lawful basis and purpose: Decide which lawful basis applies to each processing activity and record why, since no supplier can make that choice for the business.
Risk acceptance: Decide whether the residual risk after security measures is acceptable, and whether a DPIA is needed before launch.
Processor contracts: Sign the Article 28 processing agreements with each processor and approve sub-processors.
Resourcing: Fund the measures, name an owner for rights requests and breaches, and set the review cycle for the chosen measures.
Breach decisions: Decide, with advice, whether a breach must be notified to the supervisory authority within 72 hours and to affected individuals.

Before signing any contract or accepting any vendor's security claims, confirm in writing who owns each decision listed above.

What usually makes small businesses miss deadlines or fail a customer review

Most small business GDPR failures are not exotic. They come from a few assumptions about what scales down, from processes that exist only in someone's head, and from waiting for rule changes that have not taken effect. Each card below names one pitfall and the check that prevents it.

Assuming the 250-employee exemption removes record-keeping

The exemption in Article 30(5) is narrower than it sounds. It does not apply when processing is likely to result in a risk, is not occasional, or includes special category or criminal offence data. A small firm running regular HR payroll, customer profiling or health data processing usually still needs a record of processing activities. Check each processing activity against those three triggers and keep a written record for any that fail the test.

Leaving rights requests undocumented

Small teams often answer access or erasure requests from memory, so the one-month deadline is missed or the answer cannot be shown later. The EDPB's guide expects a prepared process, trained staff, an up-to-date data register and a record of every request, answer and reason for refusal. Write a one-page procedure, name the person who owns it, and keep a simple log with the date each request arrived and was closed.

Treating a supplier's terms as a processor contract

A cloud tool's standard terms of service are not automatically an Article 28 contract. Customers and assessors check whether the document sets out the subject matter, duration, purpose, data types, instructions, confidentiality, security measures, sub-processor rules and deletion or return of data. Before relying on any supplier, compare its terms against the Article 28 content and sign a data processing agreement where the supplier lacks one. The EDPB notes that such a contract is obligatory.

Having no restore test for backups

A backup policy that has never been restored is an assumption, not a control. The EDPB's minimum measures for any organization include a data backup and retrieval policy for incidents, and Article 32 expects a process for regularly testing and evaluating the effectiveness of measures. Schedule a restore of a sample dataset at least periodically, record the date, the time taken and whether the data was complete, and fix any gaps the test reveals.

Missing the 72-hour clock

When a personal data breach occurs, the controller has 72 hours to notify the supervisory authority where the breach is likely to result in a risk. Small firms often lose hours because nobody is clearly authorized to decide. Name one decision-maker and a deputy, write down the criteria for risk, and keep a template notice ready. Make sure processors know they must alert the controller without undue delay, so the clock is not lost in the supplier's inbox.

Waiting for Omnibus IV before acting

The GDPR has not been amended as of October 2026. The Omnibus IV proposal would widen the record-keeping exemption to organizations with fewer than 750 employees, but its text still awaits Parliament's first-reading vote. Current duties, including rights deadlines, security measures and processor contracts, apply now. Track the procedure, but do not postpone controls or documentation on the strength of a proposal that may change the scope later or not at all.

Questions small businesses ask before bringing in outside help

How much effort does GDPR take for a small company?

The effort depends less on headcount than on what you do with personal data. A small company that only keeps a customer mailing list and payroll has a short list of duties, while one that runs CCTV, tracks location through an app or handles health data has more. The main drivers are the volume and sensitivity of the data, how many systems and suppliers hold it, whether you can already answer access requests within one month, and whether your contracts with processors are in order. Most of the work is one-time setup (mapping data flows, writing the register, signing processor contracts, documenting security measures) followed by recurring work (reviewing measures, handling requests, updating records when systems change). Ask any consultant to split their quote into those two groups.

Can a small business do GDPR work without a consultant?

Yes, many small organizations handle the core duties in-house, and the EDPB's guide for small business is written for that audience. The obligations apply to all controllers regardless of size, so the question is whether your team can carry them out and keep them current. Staff need time to map data, write policies, answer requests within one month and check that backups and logins work as documented. Outside help makes most sense for technical gaps, such as hardening a self-hosted system, setting up logging for breach detection or testing restores. Whichever route you take, the organization stays responsible for compliance.

Is a data protection officer always required for a small business?

No. A DPO is mandatory only in specific cases, such as public authorities, or organizations whose core activities involve large-scale regular and systematic monitoring or large-scale processing of special category data. The EDPB's guide gives geolocation through a mobile app and CCTV across shopping centres or public spaces as examples of large-scale monitoring that triggers the requirement. A small business running a local shop with a single camera is unlikely to need one, but you should check the criteria against your actual processing. Even when a DPO is not required, many companies appoint a named contact for privacy questions, which is a sensible internal step.

Do we need a processor contract with our cloud provider?

Yes, when a provider processes personal data on your behalf, a written controller-processor contract is obligatory under the GDPR. The EDPB's guide for small business states this directly and notes that infringing it can carry fines of up to EUR 10 million or 2% of total annual turnover. Most major cloud and SaaS providers offer a data processing addendum, so the practical step is to locate it, accept it through the provider's terms, and file a copy with your records. Check that it covers sub-processors, security measures, breach notice and where data is stored. The European Commission and some national authorities have published template agreements you can compare against.

What does the record-keeping exemption cover, and does Omnibus IV change it?

Under Article 30(5), the duty to keep a record of processing does not apply to organizations with fewer than 250 employees, unless the processing is likely to result in a risk, is not occasional, or includes special category or criminal offence data. The EDPB's guide adds that purely occasional activities need not be recorded. Omnibus IV is still a proposal. It would extend the exemption to organizations with fewer than 750 employees unless processing is likely to be high risk, and a text agreed on 26 June 2026 awaits Parliament's first-reading vote, indicatively scheduled for 23 November 2026. Until that vote and publication happen, the current 250-employee threshold applies. Note that the exemption does not remove the need to know your data flows for rights requests and security.

Does any certificate prove GDPR compliance for a small company?

No. The GDPR requires no audit, attestation or certificate, and no certificate proves compliance on its own. Article 42 certification is voluntary, is issued for at most three years by accredited certification bodies or supervisory authorities, and does not reduce your responsibility. Be cautious with any vendor or consultant who sells a GDPR certificate as proof of compliance. Independent auditors and certification bodies issue reports and certificates, while an implementation partner can prepare your systems, documentation and evidence for review. Ask which body would issue any certificate and whether it is accredited for Article 42.

What should we ask a consultant to put in a written scope?

Ask for a scope that names each system and dataset in the engagement, the roles of your organization and the partner, and the deliverables. Good scopes list the record of processing or data map, the processor contracts to review, the security measures to document, rights-request procedures, the backup and restore test, and the breach response plan. Ask which items are one-time and which are recurring, what evidence you will receive, and what is excluded, such as legal advice or the issuing of certificates. Confirm who signs off on the final documentation and what happens if a system changes mid-engagement. Fixed-scope engagements agree these items in writing before work starts, which makes the quote easier to compare.

How long does GDPR readiness work take for a small company?

No duration is fixed by the GDPR, and the timing depends on how many systems hold personal data, how well they are documented, and how many processor contracts need review. A company with a few well-known cloud services and clear data flows will move faster than one with legacy systems or unknown shadow tools. Confirm timing with a written scope from any partner, which should state the phases, the dependencies on your staff and the points where you must provide decisions. Ask how the plan accounts for the proposed changes in Omnibus IV, since the record-keeping threshold may shift during the work.

How DeployOpen works on this

DeployOpen helps small businesses and SMEs turn the GDPR's security, rights and processor duties into working systems and written evidence inside infrastructure the organization controls. We plan, implement, document and support self-hosted open-source platforms, and we prepare evidence for an independent assessor, who alone issues any report or certificate.

How we scope

We confirm which personal data flows exist, which systems hold them and which processing is occasional or recurring.
The written scope names systems, deliverables, roles and timelines before any work starts, since most engagements are fixed-scope.
The scope states whether the organization needs a record of processing, a DPIA or a processor contract, based on agreed facts.

How we build

We configure user authentication, access control and a tested backup and retrieval process on the platforms in scope.
We set up logging and retention so rights requests, including access exports and erasure, can be answered within one month.
We run security testing against the configured systems and record findings, fixes and the review of measures over time.

How we hand over

We deliver the documentation of technical and organizational measures, the record of processing and the data flow register.
We provide the breach response steps, the 72-hour notification workflow and the templates your team needs to use them.
We walk your staff through the runbooks so the organization can operate and evidence the controls without us in the room.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, agreed in writing alongside the original scope.
We help you prepare evidence packs for a customer audit, a complaint or a supervisory authority inquiry as the need arises.
Confirm with your auditor or assessor which evidence they expect, since DeployOpen prepares material but does not issue assessments.