GDPR

GDPR applies to "personal data", meaning any information that can identify a living person directly or indirectly: a name, an email address, a phone number, an IP address, a booking history. It covers organisations based in the EU and also those outside the EU that offer goods or services to people in the EU or monitor their behaviour, such as through website tracking.

GDPR is not a cookie law, though people often treat it as one. Cookie banners come mainly from a separate rule, the ePrivacy Directive, which borrows GDPR's definition of consent. This page is general information, not legal advice.

How it works

GDPR rests on a set of principles: collect only what you need for a stated purpose, keep it accurate, keep it no longer than necessary, protect it properly and be able to show you comply. Every use of personal data needs one of six lawful bases: consent, a contract with the person, a legal obligation, protecting someone's vital interests, a public task, or legitimate interests that are balanced against the person's rights. Consent is only one option, and often not the right one; processing an order relies on the contract.

The organisation that decides why and how data is used is the controller. Suppliers that handle data on its behalf, such as hosting, email or booking tools, are processors, and the controller must have a data processing agreement with each. People have rights to access their data, correct it, have it erased in many cases, restrict or object to its use and receive it in a portable format. Requests generally must be answered within one month.

After a personal data breach, the controller must notify its supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to put people's rights and freedoms at risk, and tell the affected people directly when the risk is high. Fines for the most serious breaches can reach up to €20 million or 4% of worldwide annual turnover, whichever is higher, though regulators scale penalties to the case. The UK and several other countries have laws closely modelled on GDPR.

Example

A small physiotherapy practice in the EU reviews its website. It collects names, emails, phone numbers and a short description of the injury through a contact form, uses an analytics tool and sends a monthly newsletter. Health information is special category data under GDPR, which carries extra protection, so the practice removes the injury field from the public form and asks for those details during the appointment instead.

It then lists every tool that touches personal data (hosting, email, booking, analytics, newsletter), signs each provider's data processing agreement, sets newsletter signup to an unticked opt-in box, updates its privacy policy and adds a cookie consent banner that blocks analytics until visitors accept. Old enquiry emails older than the practice's retention period are deleted.

Why it matters for your business

For most small businesses the realistic risks are less about headline fines and more about complaints, regulator enquiries, lost trust and the cost of a breach handled badly. Good GDPR practice also reduces risk directly: data you never collected cannot leak. Compliance takes real time, especially the first audit of which tools hold what data, but much of it is routine once set up. You can check your position by listing every form, tool and spreadsheet that holds personal data and asking for each one: why we hold it, on what lawful basis, who can access it and when we delete it. If you handle sensitive data at scale, get professional advice.

Common mistakes

• Assuming GDPR does not apply because the business is small or based outside the EU while serving EU customers.
• Relying on consent for everything, including processing that is really needed to fulfil a contract.
• Using pre-ticked boxes or bundled consent for marketing emails, which does not count as valid consent.
• Collecting extra fields on forms "just in case", which increases risk without any benefit.

Questions people ask

Does GDPR apply to small businesses?

Yes. GDPR applies regardless of size whenever you process personal data of people in the EU in the course of business. A few paperwork duties are lighter for smaller organisations, but the core rules on lawful basis, security and individual rights apply to everyone. This is general information, not legal advice.

What are the fines for breaking GDPR?

The maximum for the most serious infringements is up to €20 million or 4% of worldwide annual turnover, whichever is higher, with a lower tier for other breaches. Regulators consider the nature, seriousness and duration of the breach, so actual penalties vary widely and are often far below the maximum.

Do I need a data protection officer under GDPR?

Only in certain cases: public authorities, and organisations whose core activities involve large-scale regular monitoring of people or large-scale processing of sensitive data. Most small businesses do not need a formal one, but someone should still be responsible for data protection.