GDPR for Small Business: A Practical Guide, Plus CCPA Basics

Does GDPR apply to your small business?

The EU General Data Protection Regulation (GDPR) applies to organizations established in the EU, and to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior, for example through tracking cookies. The UK has its own almost identical UK GDPR. There is no general exemption for small businesses, although a few record-keeping duties are lighter for firms with fewer than 250 employees.

Why it matters: customers increasingly expect privacy, and a website with an EU audience, a newsletter with EU subscribers or EU clients all bring GDPR into play.

GDPR for small business: key terms

Term	Meaning
Personal data	Any information about an identifiable person: name, email, IP address, location, customer ID
Controller	The business that decides why and how data is used (usually you)
Processor	A supplier that handles data on your behalf, such as an email platform or cloud host
Lawful basis	The legal reason for processing, such as consent, contract or legitimate interests
Data subject	The person the data is about

Step 1: Map the personal data you hold

List what personal data you collect, where it comes from, where it is stored, who can access it, which suppliers receive it and how long you keep it. Typical sources are website forms, online orders, newsletters, CRM records, HR files and analytics tools. This record of processing is the foundation for everything else.

Step 2: Choose a lawful basis for each use

• Contract: processing needed to deliver what the customer ordered.
• Legal obligation: such as keeping invoices for tax law.
• Legitimate interests: reasonable business uses that do not override people's rights, assessed and documented.
• Consent: freely given, specific, informed and unambiguous, such as for most marketing emails and non-essential cookies.

Step 3: Write a clear privacy notice

Your privacy notice should explain who you are, what data you collect, why, your lawful basis, who you share it with, international transfers, how long you keep it and people's rights. Write it in plain language and link it from every form and your website footer.

Step 4: Handle cookies properly

In the EU and UK, non-essential cookies such as analytics and advertising trackers need consent before they are set. Use a cookie banner that makes "reject" as easy as "accept", and do not load trackers until the visitor agrees. Privacy-focused analytics that avoid personal data can reduce the burden.

Step 5: Sign data processing agreements

Every processor, such as your email platform, cloud storage, CRM and payroll provider, needs a data processing agreement (DPA). Most major providers include one in their terms. For transfers of EU data to countries without an adequacy decision, providers usually rely on Standard Contractual Clauses; the EU-US Data Privacy Framework covers certified US companies.

Step 6: Respect individuals' rights

People can ask to access, correct, delete or move their data, object to certain uses and withdraw consent. You must normally respond within one month. Create a simple process: a contact email, an identity check, a log of requests and a template reply.

Step 7: Keep data secure

GDPR requires "appropriate technical and organizational measures". For a small business that typically means two-factor authentication, encryption on laptops and phones, access limited to those who need it, regular updates, backups and staff training. Our small business cybersecurity checklist and guide to business data backup cover these steps.

Step 8: Plan for data breaches

If a breach is likely to put people's rights at risk, you must notify the relevant supervisory authority within 72 hours of becoming aware of it, and inform affected individuals if the risk is high. Keep an internal record of all breaches, even minor ones. Ransomware is a common cause; see ransomware protection for small business.

Step 9: Marketing emails

Under EU and UK ePrivacy rules, most marketing emails to individuals need consent, with a "soft opt-in" exception for existing customers in some cases. Every email needs an easy unsubscribe. Our guide to email marketing for small business covers the practical side.

CCPA and CPRA basics for small business

The California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act (CPRA), applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above about US$25 million (adjusted for inflation), buying, selling or sharing personal information of 100,000 or more California consumers or households a year, or earning at least half of annual revenue from selling or sharing personal information.

	GDPR	CCPA/CPRA
Who it covers	Any size business handling EU residents' data	Businesses above thresholds handling California residents' data
Model	Need a lawful basis before processing	Notice and opt-out, especially for selling or sharing data
Key rights	Access, correction, deletion, portability, objection	Know, delete, correct, opt out of sale or sharing, limit sensitive data use
Website requirement	Privacy notice, cookie consent	Privacy policy, "Do Not Sell or Share My Personal Information" link where applicable, honoring Global Privacy Control signals

Many other US states have passed similar privacy laws, and India's Digital Personal Data Protection Act adds its own rules, so check where your customers live.

A one-week GDPR starter plan

Day	Task
1	Map your data and suppliers
2	Record a lawful basis for each use
3	Update your privacy notice
4	Fix cookie consent on your website
5	Collect data processing agreements from suppliers
6	Set up a data request process and breach log
7	Review security: 2FA, encryption, backups

Handling a data subject access request

1. Log the request with the date received.
2. Verify the person's identity without asking for excessive information.
3. Search your systems: email, CRM, cloud storage, accounting and support tools.
4. Provide a copy of their data and the required information about how you use it.
5. Respond within one month; extensions are allowed only for complex or numerous requests.
6. Keep a record of what you sent.

Requests are usually free to make, so plan for them as part of normal operations.

Employee data counts too

GDPR covers staff and job applicants as well as customers. Tell employees how their data is used in an employee privacy notice, limit access to HR files, keep recruitment data only as long as necessary and be careful with monitoring tools. Health information and other special category data need extra protection and a specific legal condition.

International data transfers

If your business is outside the EU, or uses suppliers outside the EU, personal data is transferred internationally. Transfers are allowed to countries with an EU adequacy decision, to US companies certified under the EU-US Data Privacy Framework, or with safeguards such as Standard Contractual Clauses. Most major cloud and software providers explain their transfer mechanisms in their data processing terms; keep a copy with your records.

The bottom line: GDPR for small business is manageable: know what data you hold and why, tell people clearly, secure it, sign agreements with suppliers and respond to requests and breaches promptly. Check whether the CCPA or other state laws also apply. This is general information, not legal advice.

Frequently asked questions

Does GDPR apply to businesses outside Europe?

Yes, if they offer goods or services to people in the EU or monitor their behavior online.

Do I need a Data Protection Officer?

Only in specific cases, such as large-scale monitoring or processing of sensitive data as a core activity. Most small businesses do not, but should name someone responsible for privacy.

Does the CCPA apply to my small business?

Only if you meet one of its thresholds, such as more than about US$25 million in annual revenue or handling data of 100,000 or more California consumers.

Do I need a cookie banner?

If you use non-essential cookies and have EU or UK visitors, yes. Essential cookies needed for the site to work do not need consent.

How long can I keep customer data?

Only as long as you need it for the purpose you collected it, plus any period required by law, such as tax rules for invoices. Set retention periods for each type of data and delete or anonymize data afterwards.

What happens if a small business breaks GDPR?

Regulators usually start with guidance or orders to fix problems, but fines are possible, along with complaints from customers and reputational damage. Showing documented, good-faith compliance efforts helps.