Does My Small Business Really Need to Worry About GDPR?

GDPR is sometimes associated with large corporations, complex compliance programmes and lengthy legal documents. But data protection law applies to many ordinary business activities carried out by small and growing organisations.

If you use personal information, GDPR is relevant

Customer names, email addresses, telephone numbers, employee records, booking information, CCTV footage and online identifiers can all be personal data. If your business collects or uses this type of information, data protection requirements are likely to be relevant.

Start with what you actually do

Compliance does not need to begin with a huge policy library. Start by understanding what personal information the business collects, why it needs it, where it is stored, who receives it and how long it is kept.

Be transparent with people

Customers and employees should be given appropriate information about how their data is used. Clear privacy notices are one of the foundations of good data protection practice.

Protect the information you hold

Businesses should have security measures appropriate to their size, systems and the sensitivity of the information involved. That may include access controls, secure devices, sensible password practices, backups and appropriate supplier arrangements.

Know how to handle individual rights

People can exercise rights over their information, including asking for access to it. Staff should know how to recognise a request and where it should be escalated.

Prepare for mistakes

Emails can be sent to the wrong person, devices can be lost and accounts can be compromised. A simple breach procedure helps the business respond quickly and assess whether regulatory notification is required.

Keep compliance proportionate

A small local business does not necessarily need the same governance framework as a multinational organisation. The controls should reflect the information you use, your risks and the way the business operates.