GDPR Compliance Guide for SMEs

What EU GDPR is

GDPR — the General Data Protection Regulation, Regulation (EU) 2016/679 — entered into force on 25 May 2018, replacing the Data Protection Directive 95/46/EC. Unlike a directive, it applies directly in all EU member states without national implementing legislation, creating a uniform set of rules across all 27 member states. It is enforced by national data protection authorities (DPAs) and coordinated at EU level by the European Data Protection Board (EDPB).

Who must comply

EU GDPR applies to any organisation established in the EU that processes personal data. Under Article 3(2), it also applies to organisations outside the EU that offer goods or services to EU individuals or monitor their behaviour. There is no minimum size threshold. Every data controller subject to GDPR must be able to demonstrate compliance — the accountability principle under Article 5(2) is not optional.

The five governance areas

1. Data audit and mapping

Before any other obligation can be addressed, an organisation must know what personal data it holds, why, where it came from, who it shares it with, and how long it keeps it. This is the foundation of the Article 30 Record of Processing Activities (ROPA) — the document supervisory authorities request first in any investigation.

2. Lawful basis and consent

Every processing activity must have a documented lawful basis under Article 6. For special category data, an Article 9(2) condition must also be documented. Where legitimate interests is relied upon, a Legitimate Interests Assessment must be conducted and retained. Where consent is relied upon, a valid consent record must be maintained.

3. Privacy notices, policies, and processor agreements

Articles 13 and 14 transparency requirements mandate that data subjects are informed of processing purposes and lawful basis at the point of data collection. Where personal data is processed by a third party on your instructions, a Data Processing Agreement compliant with Article 28(3) must be in place before processing begins.

4. Data subject rights and security

Articles 15 to 22 give data subjects eight distinct rights, each requiring an operational procedure. Technical and organisational security measures appropriate to the risk must be implemented under Article 32. A breach log and 72-hour notification procedure should be in place before any breach occurs.

5. Training, accountability, and ongoing governance

Article 5(2) requires organisations to demonstrate compliance. Staff training should be documented. Internal review processes are commonly used to demonstrate compliance with the accountability principle. Where a DPO is required under Article 37, their appointment and independence must be evidenced. Compliance is an ongoing obligation — not a one-time project.

Enforcement

National DPAs can issue fines of up to €20 million or 4% of annual worldwide turnover for serious breaches under Article 83(5), and up to €10 million or 2% of turnover for less severe infringements. EU GDPR enforcement has produced some of the largest data protection fines in history. National DPAs also investigate SMEs — SAR failures, inadequate security, and marketing without consent attract consistent enforcement action across member states.

The evidence record

Compliance that cannot be demonstrated is, from a regulatory perspective, no compliance at all. GDPRLedger governs the proof the work was done — 54 tasks for Standard, 87 for professional services Pro — producing a timestamped, SHA-256 tamper-evident evidence pack that is yours permanently.

EU GDPR guides

Fundamentals

• What is GDPR — the complete explanation
• Lawful basis for processing
• Data subject rights — all eight
• How to handle a Subject Access Request
• Data breach notification — 72 hours
• Privacy notices — mandatory content
• Records of Processing Activities (ROPA)
• Data retention under EU GDPR
• When you need a DPO
• Cookies and consent — EU GDPR and ePrivacy
• International data transfers — SCCs and adequacy

By sector

• GDPR for accountants
• GDPR for solicitors and law firms
• GDPR for letting agents
• GDPR for HR and employers
• GDPR for small businesses

Research

• GDPR fines and enforcement — what the record shows
• UK GDPR vs EU GDPR — post-Brexit differences
• GDPR vs old Data Protection Directive — what changed

Note: EU GDPR applies directly across all 27 member states, but national law overlays — particularly on employment data, special category processing, and AML retention — vary materially between jurisdictions. Confirm requirements with a practitioner familiar with the relevant member state law.