GDPR checklist for small businesses: 12 steps for your website

A small business is not exempt from the GDPR. If you offer goods or services to people in the EU, or track their behavior on your website, the regulation applies whatever your size, and most of its duties are the same for a five-person shop as for a large company. The good news is that, for a typical website, compliance comes down to a dozen concrete tasks, most of which you do once and review once a year. This checklist follows the order in which they are easiest to do.

1. What personal data do you actually hold?

Start with an inventory: the contact form, newsletter sign-ups, customer accounts, orders and invoices, support e-mails, analytics and advertising cookies, chat widgets, job applications. For each, note what data is collected, why, where it is stored, who can see it, which provider processes it, and how long you keep it. Article 30 requires a written record of processing activities. Businesses with fewer than 250 employees are exempt only if the processing is occasional, unlikely to result in a risk, and does not include special categories of data; a website that collects contacts every day is not occasional, so in practice most small businesses keep the record. A spreadsheet is enough.

2. Which legal basis covers each use?

Article 6 lists six legal bases. A small business website mostly uses three: contract for processing an order or an account, legal obligation for invoices and tax records, and consent for newsletters and non-essential cookies. Legitimate interest can cover fraud prevention or direct marketing to existing customers, but it needs a written balancing test. Write the basis next to each line of your inventory, because the privacy policy must state it.

3. Do your cookies wait for consent?

Under the ePrivacy rules, analytics, advertising and most embedded content need consent before they are stored or read on the visitor's device. That means a banner with Accept and Reject on the first screen, nothing pre-ticked, and tags that actually wait for the choice. The banner is the visible part; the blocking is what authorities check. Checking cookies before consent shows how to test it in five minutes with your browser.

4. Is your privacy policy complete?

Articles 13 and 14 list what you must tell people: who you are and how to contact you, the purposes and legal bases, the recipients and processors, transfers outside the EU and their safeguard, retention periods, the rights people have, the right to complain to a supervisory authority, and whether providing data is required. Does my website need a privacy policy walks through the contents. Link it from every page and from each form.

5. Have you signed processor agreements?

Every provider that processes personal data for you (hosting, e-mail marketing, analytics, CRM, payment, support desk) is a processor, and Article 28 requires a contract with specific clauses. Most providers publish a data processing agreement (DPA) that you accept in the account settings or download. Collect them in one folder.

6. Are transfers outside the EU covered?

Sending data to a provider in a country without an adequacy decision needs a safeguard, usually the standard contractual clauses included in the provider's DPA. For US providers, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, which covers companies that have certified under it; check the provider's certification.

7. Can you answer a request within a month?

People can ask for a copy of their data, correction, deletion, restriction, portability, and can object to processing. Article 12 gives you one month to answer, extendable by two months for complex requests. Decide who handles requests, how you verify identity, and where you look for data (the inventory from step 1 is the map).

8. Is the data secure?

Article 32 asks for security appropriate to the risk. For a small business that means unique accounts with two-factor authentication on every tool, least-privilege access, updates applied, encrypted backups, HTTPS everywhere, and removing access when someone leaves.

9. Do you know what to do after a breach?

A lost laptop, a hacked mailbox or a misdirected e-mail with customer data can be a personal data breach. Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people, and Article 34 requires telling the people affected when the risk is high. Write down who decides, and keep a log of every incident, including those you did not notify.

10. Do you keep data only as long as needed?

Set retention periods per category: invoices for the period your tax law requires, prospects for a fixed time after the last contact, consent records for as long as you rely on the consent and the limitation period after it, as explained in how long to keep consent records. Delete or anonymize the rest on a schedule.

11. Do you need a DPO or an EU representative?

A data protection officer is required under Article 37 only for public authorities and for organizations whose core activities involve large-scale regular monitoring of people or large-scale processing of sensitive data. Most small businesses do not need one, but someone should own the topic. A business with no establishment in the EU that targets EU customers must usually appoint a representative in the EU under Article 27.

12. Do you review it once a year?

Add a yearly review to the calendar: new tools added to the site, new forms, providers changed, cookies that appeared. A scan of the site shows which trackers are present today, which is often not what the privacy policy describes.

What does it cost to get wrong?

Fines under Article 83 reach 20 million euros or 4% of worldwide annual turnover for the most serious breaches, and authorities must keep them proportionate. For small businesses, the more common outcome is a complaint, an order to fix, and a smaller fine. The GDPR page lists the rules in detail.

Where does a consent tool fit?

Steps 3, 4 and part of 10 are what a consent tool automates. Cookiequiet's free plan covers one website: one script tag placed before your other scripts, Reject all on by default, Google Consent Mode v2 switched on in the snippet the dashboard gives you, a scan that fills the cookie table and prefills the privacy and cookie policies, and a consent log. It takes about five minutes from sign-up to a live banner; the free cookie scanner shows what your site sets today without an account.