GDPR anxiety scales inversely with company size: the smallest teams often assume they need enterprise-grade privacy programs, then do nothing because that feels impossible. The truth is more manageable. GDPR applies to you if you process personal data of people in the EU — but what it demands of a 15-person SaaS is not what it demands of a bank.
The obligations that genuinely apply
- A lawful basis for each processing purpose — for most small B2B companies that's contract performance and legitimate interest, with consent reserved for marketing.
- A privacy notice that honestly describes what you collect and why, in language a customer can read.
- A record of processing activities — for a small company, a well-kept spreadsheet is legitimate.
- The ability to answer data subject requests (access, deletion, portability) within a month.
- Data processing agreements with the vendors that touch personal data for you.
- Breach awareness: know what qualifies, and be able to notify your supervisory authority within 72 hours.
What you probably don't need
Most small businesses don't need a Data Protection Officer — that's triggered by large-scale monitoring or special-category processing, not headcount. You likely don't need consent banners for strictly necessary cookies, and you don't need a 40-page policy no one reads. Regulators consistently reward honest, proportionate programs over paperwork theatre.
A weekend-sized starting plan
- List every place personal data enters and lives: forms, CRM, analytics, support desk, payroll.
- Write the processing record from that list and assign each purpose a lawful basis.
- Fix the leaks the list exposes — the analytics tool nobody uses, the export sitting in someone's downloads folder.
- Collect signed DPAs from your processors; the major platforms all have them ready.
- Draft the breach playbook: who decides, who notifies, within what window.
Proportionate, documented and honest beats elaborate and abandoned — and it's within reach of any team that can spare a focused week.
