The Fines Are Real — and They Are Not Reserved for Big Tech
The narrative that GDPR only targets tech giants is wrong. Consider the actual enforcement record:
- A Portuguese medical clinic: €150,000 for allowing unauthorised staff to access patient records
- A Danish taxi company: €160,000 for retaining passenger data longer than permitted
- A Romanian operator: €130,000 for implementing inadequate technical security measures on a website
- A Bulgarian credit reference agency: €500,000 for a data breach affecting millions — but the percentage of turnover was actually similar to the smaller cases above
The pattern is clear. Supervisory authorities across the EU are enforcing against businesses of all sizes. Ignorance of the regulation is not a mitigating factor. Having a website with a contact form and no privacy policy is not a grey area — it is a violation.
What GDPR Actually Is
GDPR stands for General Data Protection Regulation. Its full reference is EU Regulation 2016/679. It came into force on 25 May 2018 and replaced the previous 1995 Data Protection Directive.
Two things make GDPR unusual compared to most EU regulations:
- It applies regardless of where your business is based. If you process personal data of EU residents, GDPR applies — whether you are in Berlin, Dublin, or New York.
- It directly imposes obligations on businesses, not just on EU member states. No implementation into national law is required for the core obligations to apply.
What "Processing" Means
Processing covers essentially every action you take with data: collecting it, storing it, reading it, analysing it, sharing it with third parties, and deleting it. If your website has a contact form, you are processing data. If you have an email list, you are processing data. If you use Google Analytics, you are processing data (specifically passing IP addresses to Google).
You do not need to be storing data in a database to be processing it. Receiving an email from a customer and storing it in your inbox is processing.
What "Personal Data" Includes
Most small business owners think of personal data as names, email addresses, and phone numbers. GDPR's scope is significantly broader:
| Data type | Examples |
|---|---|
| Direct identifiers | Name, email address, phone number, national ID number |
| Online identifiers | IP address, cookie ID, device fingerprint, user account ID |
| Location data | GPS coordinates, delivery addresses, check-in data |
| Professional data | Job title + employer name (when it identifies a specific person) |
| Special category data | Health records, biometric data, political opinions, religious beliefs |
Special category data carries stricter rules and can trigger the DPO requirement if processed at scale.
The 6 Legal Bases for Processing
You must have a valid legal basis for every processing activity. The six options are:
| Legal basis | When it applies |
|---|---|
| Consent | The individual has given clear, specific, informed, and freely given consent |
| Contract | Processing is necessary to perform a contract with the individual |
| Legal obligation | Processing is required by EU or member state law |
| Vital interests | Processing is necessary to protect someone's life |
| Public task | Processing is carried out in the public interest or official authority |
| Legitimate interests | Your interests (or a third party's) outweigh the individual's privacy interests |
For most small businesses, the relevant bases are consent, contract, and legitimate interests. Relying on legitimate interests requires a documented balancing test — it is not a catch-all.
The 5 Things Every Small Business Must Have
1. A Privacy Policy on Your Website
A publicly accessible privacy policy is mandatory if you collect any personal data. It must explain what data you collect, why, what legal basis you rely on, how long you keep it, who you share it with, and what rights the individual has. A vague paragraph about "protecting your privacy" does not satisfy GDPR.
2. A Cookie Consent Mechanism
If your site uses any non-essential cookies — Google Analytics, Meta Pixel, Hotjar, embedded YouTube videos — you need a cookie consent banner that obtains opt-in consent before those cookies are set. Pre-ticked boxes and "by continuing to browse" language are not valid consent under GDPR.
3. A Process for Handling Data Subject Requests
Individuals have the right to request access to their data, correction of inaccurate data, deletion of their data, and portability of their data. You must be able to respond to these requests within 30 days. This does not require sophisticated software — a documented process and a designated email address are sufficient for most small businesses.
4. A Data Breach Response Plan
If personal data is breached — accessed by an unauthorised party, accidentally emailed to the wrong recipient, lost on a stolen laptop — you have 72 hours to notify your national supervisory authority if the breach poses a risk to individuals. This requires knowing who to notify, having an incident log, and being able to assess the risk quickly. A one-page internal procedure is sufficient.
5. A Record of Processing Activities (Article 30)
Article 30 requires organisations to maintain a record of their data processing activities. For small businesses with fewer than 250 employees, a simplified version applies unless the processing is high-risk. A spreadsheet listing each processing activity (e.g. "email newsletter"), the data categories, the legal basis, the retention period, and any third-party processors satisfies this requirement.
What GDPR Does NOT Require
There is as much misinformation about what GDPR mandates as about what it prohibits:
- You do not need a DPO unless you are doing large-scale systematic monitoring or processing special category data at scale
- You do not need consent for every processing activity — contract performance and legitimate interests are valid bases that do not require a consent mechanism
- You do not need to remove all cookies — strictly necessary cookies do not require consent
- You do not need to encrypt everything — GDPR requires "appropriate technical measures," which is risk-proportionate, not absolute
The Fine Structure
| Violation tier | Examples | Maximum fine |
|---|---|---|
| Administrative violations | Failing to maintain Article 30 records, not appointing a DPO when required | €10M or 2% of global turnover |
| Serious violations | Unlawful processing, violating data subject rights, transferring data outside EU unlawfully | €20M or 4% of global turnover |
For a small business with €300,000 annual revenue, the 4% cap is €12,000. That is a realistic fine for a serious violation — not the €20 million maximum, but enough to cause serious financial harm.
Start With a Compliant Privacy Policy
The single highest-leverage action most small businesses can take is publishing a GDPR-compliant privacy policy. It demonstrates accountability, satisfies the transparency requirement, and is a prerequisite for lawful data collection.
Use the free GDPR Privacy Policy Generator on this site to create a policy tailored to your business type, the data you collect, and the tools you use — in under five minutes.
Sources: EU Regulation 2016/679 (GDPR); EDPB enforcement tracker; national supervisory authority fine registers (CNPD Portugal, Datatilsynet Denmark).