GDPR for small businesses: the essentials without the jargon

GDPR for small businesses: the essentials without the jargon

Jordan Gall, Head of Cybersecurity, Buchanan Technology

What it is

GDPR (the General Data Protection Regulation) is the EU's data protection law. It has been in force since 2018, and most small business owners still think of it as a European problem that does not apply to them. That is wrong if you touch EU data at all.

GDPR applies to any organisation that processes personal data of people in the EU, regardless of where the organisation is located. If your website has visitors from Europe, your online store ships there, or you hold client records for an EU-based customer, you are in scope. The regulation follows the data, not your postcode.

For a small business, "personal data" is broader than most people assume. It covers names and email addresses, yes, but also IP addresses collected by your website, cookie consent data, CRM records, CCTV footage, and even information sitting in spreadsheets or paper files. If you can use it to identify a person, it counts.

Why you need to care

The fines are real, and they scale down. The maximum fine is the greater of 20 million euros or 4 percent of global turnover. In practice, regulators calibrate penalties to the size of the business, but even a small firm can face six-figure penalties for a serious breach, plus legal costs and client compensation claims on top.

Your clients are asking. If you work with larger companies or EU-based clients, they will pass their GDPR obligations down to you as a processor. Expect questions about where data is stored, who can access it, and what happens in a breach. A small firm that cannot answer those questions simply loses the contract.

It overlaps with Australian law. If you are an Australian business, the Privacy Act and the upcoming reform package cover domestic handling of personal information, while GDPR covers your EU exposure. The two regimes pull in the same direction: know what data you hold, keep it secure, and be ready to tell people what happened when something goes wrong. Getting the basics right once satisfies most of both.

One incident can trigger everything. A single breach, such as a compromised CRM containing EU customer records, can trigger GDPR notification duties within 72 hours, client contractual notices, and an OAIC complaint in Australia at the same time. The businesses that handle this well are the ones that already know what data they hold and where it lives.

What you can do about it

You do not need a data protection officer or a legal team to get this right. You need the basics done properly:

1. Build a simple record of what you hold. A one-page inventory per data type: what it is, where it lives (CRM, email, spreadsheets, cloud storage, paper), who can access it, and why you are holding it. This single document answers most of the questions a client, insurer, or regulator will ever ask.

2. Check how your website handles EU visitors. If your site uses analytics, cookies, or marketing pixels that reach people in the EU, you need a lawful basis for tracking them. In practice this means a proper consent banner that does not pre-tick boxes and respects the choice. Many Australian sites run US-style tracking on by default, which is exactly what regulators flag.

3. Put the basic security controls in place. GDPR is not only about paperwork; it requires appropriate technical measures. For a small business that means: MFA on everything, access control so staff only see what their role needs, encryption of data at rest and in transit, reliable backups, and a patching routine. These are the same controls you need for ransomware, so they pay for themselves twice.

4. Know your 72 hours. If a breach affects EU personal data, you must notify the relevant supervisory authority within 72 hours of becoming aware of it, and affected individuals without undue delay if the risk is high. The only way to hit that window is to know what you hold and where, which brings us back to step one.

5. Review your contracts and sub-processors. If a cloud provider, marketing tool, or accountant processes personal data on your behalf, GDPR requires a data processing agreement between you and them. Most mainstream providers (Microsoft, Google, AWS) offer standard templates. The gap is usually the small local vendor, or the spreadsheet shared with a contractor that nobody has thought about.

6. Make deletion a habit. You are only allowed to keep personal data as long as you have a reason for it. A quarterly check of old client lists, departed staff accounts, and archived projects keeps your exposure down and makes any breach notice much shorter to write.

The bigger point

GDPR gets a bad reputation because it is written like a legal document and enforced with scary numbers. Strip that away and the regulation asks for six things every sensible business should be doing anyway: know what data you hold, get consent properly, secure what you have, be ready to respond quickly, put your suppliers in writing, and delete what you no longer need.

For an Australian small business, the smartest way to think about GDPR is not "am I compliant?" but "if a breach happened tomorrow, could I explain what data was affected, where it lived, who had access, and what I did about it within 72 hours?" If the answer is yes, you are further along than most of your competitors.

If you want a one-page data inventory for your business, or a review of your website's tracking and consent setup, get in touch. A short conversation today is a lot cheaper than a regulator's letter next month.