GDPR compliance checklist for small businesses

GDPR applies to the newsletter list, the CRM, the payroll spreadsheet and the analytics on your website — and to businesses far outside Europe that sell to Europeans. This guide explains what GDPR compliance actually requires, who it applies to, how the UK version differs, what changed in 2025–2026, and gives you a checklist you can work through with a small team.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 17 min read

What is GDPR?

The General Data Protection Regulation (Regulation (EU) 2016/679) has applied across the EU since 25 May 2018, and across the wider European Economic Area through the EEA Agreement. It governs the processing of personal data — any information relating to an identified or identifiable living person, from a name and email address to an IP address, a cookie identifier or a photo.

After Brexit, the UK kept the GDPR in domestic law as the UK GDPR, alongside the Data Protection Act 2018. The two remain closely aligned, and a business that complies with one is most of the way to the other, but they are now separate laws with separate regulators and diverging details (see UK GDPR below).

The core of the law is seven principles in Article 5. Almost every checklist item traces back to one of them:

Why GDPR was introduced

GDPR stands for the General Data Protection Regulation. It replaced the 1995 Data Protection Directive (95/46/EC), which every member state had implemented in its own way, so a business selling across Europe faced different rules in each country. Adopted in April 2016 with a two-year run-in, the GDPR is a regulation: it applies directly in every member state. It also updated the rules for the internet era of cloud services, social media and online tracking, strengthened individuals’ rights, made organisations responsible for demonstrating compliance rather than just following rules, and introduced turnover-based fines large enough to matter to global companies.

Key GDPR terms

Who must comply — including non-EU businesses

GDPR applies in two situations (Article 3):

• Establishment — you have an establishment in the EU (an office, branch or subsidiary) and process personal data in the context of its activities, wherever the processing happens.
• Targeting — you are not established in the EU but you offer goods or services to people in the EU (paid or free), or monitor their behaviour in the EU, for example through tracking cookies, profiling or behavioural advertising.

“Offering” means more than a website that happens to be reachable from Europe. Signals include pricing in euros, EU shipping options, a local-language site or domain, and marketing aimed at EU customers. A US online store that ships to Germany and runs retargeting ads in France is in scope; a local US restaurant whose website an Italian tourist visits is not.

The EU and UK representative

A business caught by the targeting rule usually has to appoint a representative in an EU member state where its data subjects are (Article 27). There is a narrow exemption for processing that is occasional, does not involve large-scale special category or criminal data, and is unlikely to result in a risk to individuals. The UK GDPR has a mirror rule: a business outside the UK that targets UK individuals generally needs a UK representative. Commercial representative services exist for both.

Controller or processor?

A controller decides why and how personal data is processed — for your own customers and staff, that is you. A processor acts on a controller’s instructions — your email platform, payroll bureau or cloud host. If you sell software or services that handle your clients’ customer data, you are their processor and have your own obligations, including security, sub-processor controls and breach notification to the controller.

Individuals’ rights under GDPR

GDPR gives people eight rights over their personal data. Most must be answered within one month of the request, extendable by two further months for complex or numerous requests, and generally free of charge.

GDPR compliance checklist

Work through the sections in order. Each unticked item is a gap: record it with an owner and a date (see GDPR risks to log).

1. Governance and accountability

• ☐ Name one person accountable for data protection, with time to do it.
• ☐ Decide whether you need a Data Protection Officer (see below) and record the decision either way.
• ☐ If outside the EU/UK but targeting people there, appoint an EU and/or UK representative and name them in your privacy notice.
• ☐ UK organisations: check whether you must pay the data protection fee to the ICO, and pay it.
• ☐ Adopt a short data protection policy and get senior sign-off.

2. Know your data

• ☐ Map what personal data you hold, about whom, where it is stored, who has access and which suppliers process it.
• ☐ Keep a record of processing activities (Article 30). The exemption for organisations under 250 employees does not apply if processing is more than occasional, likely to pose a risk, or involves special category data — so in practice most businesses need one for at least their core processing.
• ☐ Flag special category data (health, ethnicity, religion, biometrics, sexual orientation, trade union membership and others) and criminal offence data — both need extra conditions.

A data inventory is also the foundation of a data governance framework; build them once, together.

3. Lawful basis and transparency

• ☐ Record a lawful basis for each purpose: consent, contract, legal obligation, vital interests, public task or legitimate interests.
• ☐ Where you rely on legitimate interests, document a short balancing test (legitimate interests assessment).
• ☐ Where you rely on consent, make it freely given, specific, informed, unambiguous and as easy to withdraw as to give — and keep records of it.
• ☐ Publish a privacy notice that covers who you are, what you collect, why, the lawful basis, recipients, transfers abroad, retention, rights and how to complain.
• ☐ Give staff and job applicants their own privacy notice.

4. Cookies and marketing

• ☐ Get prior consent for non-essential cookies and similar trackers (analytics, advertising, session replay) under the ePrivacy rules — in the UK, PECR. Reject must be as easy as accept.
• ☐ Check that tags do not fire before consent and that your consent banner records choices.
• ☐ For email and SMS marketing, have consent or a valid soft opt-in for existing customers, and an unsubscribe in every message.
• ☐ Suppress, rather than delete, people who opt out, so they are not re-added.

A note on Google Analytics and similar tools. In 2022 the Austrian, French and Italian data protection authorities found that particular websites’ use of Google Analytics breached GDPR, because data went to the US without adequate protection. Since July 2023, transfers to US companies certified under the EU–US Data Privacy Framework can rely on an adequacy decision; the EU General Court upheld the framework in September 2025, but an appeal to the Court of Justice is pending. Transfers aside, analytics cookies still need consent (subject to the new UK exemptions described below), a mention in your privacy notice and sensible settings such as limited retention.

5. Individuals’ rights

• ☐ Have a process for subject access requests (respond within one month, extendable by two months for complex or numerous requests).
• ☐ Handle requests for rectification, erasure, restriction, portability and objection — including the absolute right to object to direct marketing.
• ☐ Verify identity proportionately, without asking for more data than needed.
• ☐ Log every request, the response and the date.
• ☐ Train front-line staff to recognise a request: it does not need to mention GDPR or use any particular words.

6. Security

• ☐ Base security measures on a risk assessment — see cybersecurity risk assessment.
• ☐ Enforce multi-factor authentication on email, admin and cloud accounts.
• ☐ Encrypt laptops and mobile devices; use encrypted transfer for personal data.
• ☐ Limit access by role; remove leavers promptly; review access to sensitive data periodically.
• ☐ Keep backups you have tested restoring.
• ☐ Train staff on phishing and on handling personal data — see phishing risk.

7. Processors and suppliers

• ☐ List every supplier that processes personal data for you, including SaaS tools bought on a card.
• ☐ Have an Article 28 data processing agreement with each one.
• ☐ Check their security in proportion to the risk — see third-party risk assessment.
• ☐ Track sub-processors and how you are notified of changes.

8. International transfers

• ☐ Identify personal data leaving the EEA (or the UK), including to suppliers’ support teams and cloud regions.
• ☐ Rely on an adequacy decision where one exists — for example, EU–UK transfers rely on adequacy decisions the Commission renewed in December 2025, and EU–US transfers to certified companies can use the EU–US Data Privacy Framework.
• ☐ Otherwise use Standard Contractual Clauses (EU) or the IDTA or UK Addendum (UK), with a transfer risk assessment.

9. Breaches

• ☐ Have a breach procedure: contain, assess, record, notify.
• ☐ Notify the supervisory authority within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals.
• ☐ Tell affected individuals without undue delay where the breach is likely to result in a high risk to them.
• ☐ Record every breach internally, including those you decide not to report, with your reasoning.

The detailed playbook is in our data breach response plan guide.

10. Retention and high-risk processing

• ☐ Set retention periods for each category of data and run the deletion.
• ☐ Carry out a Data Protection Impact Assessment (DPIA) before processing likely to result in a high risk — large-scale special category data, systematic monitoring, new technologies such as AI applied to individuals.
• ☐ Build privacy into new projects and product features from the start.
• ☐ Review the checklist annually and after significant changes.

Do you need a DPO?

A Data Protection Officer is mandatory (Article 37) only if you are a public authority, or your core activities consist of large-scale regular and systematic monitoring of individuals, or large-scale processing of special category or criminal offence data. A small online shop, agency or software company usually does not meet the test. A private clinic group, a background-screening firm or an ad-tech business may. If you appoint a DPO voluntarily, the full DPO rules on independence and reporting apply, so many small businesses instead name a “privacy lead” with a different title.

GDPR fines and enforcement

Article 83 sets two tiers of administrative fines. Regulators must make fines effective, proportionate and dissuasive, considering the nature, gravity and duration of the infringement, intent or negligence, mitigation, previous infringements and cooperation.

Fines make headlines, but for a small business the more likely consequences are a regulator’s reprimand or order, the cost of handling a breach, compensation claims from individuals, and lost customer trust. Regulators also take into account whether you had done the basics — which is exactly what the checklist above produces evidence of.

UK GDPR and the Data (Use and Access) Act 2025

The UK GDPR started as a copy of the EU text. The Data (Use and Access) Act 2025 (DUAA) amended it, along with the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). The data protection changes were brought into force in stages: some from late 2025, most on 5 February 2026, and a further set — including the new complaints-handling duty — scheduled for June 2026. Key changes for businesses include:

• Recognised legitimate interests — a short list of purposes (such as certain security, crime-prevention and safeguarding uses) that no longer need a balancing test.
• Cookies — new exemptions from consent for some low-risk purposes, such as certain analytics and service-improvement uses, subject to conditions including a way to object.
• PECR fines — maximum penalties for cookie and marketing breaches raised to UK GDPR levels.
• Subject access — confirmation that searches need to be reasonable and proportionate, and clarity on when the response clock stops while you wait for information from the requester.
• Automated decision-making — rules relaxed for decisions not involving special category data, with safeguards such as the right to human review.
• Complaints — controllers must have a process for handling data protection complaints from individuals and must acknowledge them within 30 days.

The EU renewed its adequacy decisions for the UK in December 2025, after reviewing these changes, so EU–UK data flows continue without extra safeguards. Exact commencement dates and the ICO’s updated guidance are on GOV.UK and ico.org.uk; check them before changing your cookie banner or legitimate interests assessments.

EU changes: the Digital Omnibus proposal

In November 2025 the European Commission published a “Digital Omnibus” package that, among other things, proposes amendments to the GDPR and the ePrivacy rules. Proposals reported by law firms and in the Commission’s text include:

• A narrower, entity-relative reading of “personal data”, so pseudonymised data may fall outside the GDPR for a recipient that cannot re-identify individuals.
• Breach notification to the authority only for breaches likely to result in a high risk, within 96 hours rather than 72, through a single EU reporting point.
• Clarification that legitimate interests can be a lawful basis for developing and operating AI systems, with safeguards.
• Allowing controllers to refuse or charge for clearly abusive access requests.
• Changes to the consent rules for cookies.

Status as at 30 October 2026: these are proposals, not law. Reports indicate the Council agreed its negotiating mandate on the data part of the package in October 2026, with changes to the Commission’s text (for example keeping cookie rules in the ePrivacy Directive). The European Parliament had not yet adopted its position, so trilogue negotiations were still ahead. Until a final text is adopted and in force, the current GDPR applies in full — including the 72-hour breach deadline. Do not redesign your compliance programme around draft provisions.

GDPR risks to log in your risk register

Checklist gaps that you cannot close straight away are risks. Put them in your risk register alongside other compliance risks, scored on the same matrix, with an owner and a target date. Examples:

Scores are illustrative. A good indicator set for data protection: open subject access requests near the deadline, suppliers processing personal data without a DPA, breaches recorded this quarter and time to decision, and high-risk projects started without a DPIA.

Common mistakes

• Copying a privacy notice from another site. It describes their processing, not yours — and regulators notice.
• Treating consent as the default basis. For many purposes contract or legitimate interests fit better; consent is hard to maintain and can be withdrawn.
• A cookie banner that does nothing. If tags fire regardless of the choice, the banner is evidence against you.
• Forgetting staff data. HR, payroll, recruitment and monitoring of employees are all in scope.
• Assuming GDPR stops at the EU border. Targeting EU or UK customers brings you in.
• Compliance as a one-off project. New tools, suppliers and marketing campaigns change your processing every month.