GDPR for small businesses

GDPR has a fearsome reputation, but the core duties are manageable.

Here's the practical shortlist — though for your specific obligations, a qualified advisor is the right call.

01 Know what data you hold

You can't protect what you haven't mapped. A simple inventory of what personal data you keep and where is the starting point.

02 Collect only what you need

GDPR rewards restraint. Holding data "just in case" is a liability, not an asset. If you don't need it, don't keep it.

03 Keep it secure

Access control, encryption of sensitive data, patched systems and tested backups aren't just good IT — they're how you meet the "appropriate security" the rules expect.

04 Have agreements with your processors

When another company handles data for you — your IT provider included — a Data Processing Agreement should set out the terms. It's standard and expected, not a hurdle.

05 Have a plan for a breach

Serious breaches must be reported, often within tight timeframes. Knowing who does what in advance saves panic later.