In brief: For data protection, an SME usually has to get five things done: keep records of processing activities, sign data processing agreements with every provider, have a privacy policy that matches the website, document technical and organisational measures, and train the staff. Two deadlines come on top: one month to answer requests from data subjects, and where possible 72 hours to report a data breach to the data protection authority (Art. 12 and 33 GDPR, source: eur-lex.europa.eu and wko.at, as of October 2026). This roadmap draws on around 30 implementation projects since 2018, from medical practices to education providers.
Does the GDPR apply to small businesses too?
Yes. The GDPR applies as soon as a business processes personal data, meaning customer, employee or supplier data. There is no minimum headcount, sole traders are covered too. The obligations are the same for everyone. The effort depends on how many processing operations the business has. For an SME this is not a year-long project and can be done in seven steps.
Step 1: Which data does your business process?
Half a day with the right questions: which personal data enters the company (customers, employees, suppliers), where is it stored, who has access, which tools are in use? The result is the map for everything that follows.
Step 2: Does an SME need records of processing activities?
As a rule, yes. The records of processing activities (Art. 30 GDPR) are mandatory, and at the same time the most useful document of the entire project: for each processing operation, purpose, legal basis, categories, recipients and deletion periods sit in one place. Done well, it answers most of the questions that come up later.
The exemption for businesses with fewer than 250 employees almost never applies. According to the Austrian Economic Chamber (WKO) it only holds if, in addition, the processing poses no risk to the people concerned, happens only occasionally and includes no sensitive data. A business that runs a payroll or keeps a customer file does not process only occasionally and needs the records (Art. 30(5) GDPR, source: wko.at, in German, as of 8 October 2026). The WKO notes that widening this exemption is currently under discussion ("Omnibus IV"). For now the rule stands as described.
Step 3: On which legal basis do you process the data?
Most SME processing operations rest on contract (Art. 6(1)(b)), legal obligation (point (c)) or legitimate interest (point (f)). Consent is needed less often than many believe, and where it is, it must be documented and revocable.
Step 4: Which providers need a data processing agreement?
Hosting, email, accounting software, cloud storage: anyone processing personal data on your behalf needs a data processing agreement (Art. 28). For providers outside the EU, check in addition: adequacy decision or standard contractual clauses. What goes into the agreement and who signs it is covered in the article Data processing agreement (DPA): when required, what goes in.
Step 5: Does the privacy policy match the website?
The most common weak point: boilerplate text describing services that don't (or no longer) exist on the website, or the other way round. The policy must reflect the actual state of affairs: services in use, purposes, legal bases, data subject rights, and the complaint route to the data protection authority. Whether the website needs a cookie banner at all is what the free Cookie Banner Check shows.
Step 6: Which technical and organisational measures (TOMs) does an SME need?
Encryption, access controls, backups, password rules, handling of mobile devices, documented and appropriate to the risk. For an SME, what counts is traceability, not perfection.
Step 7: How do you train your staff?
Short, specific and repeated. Most data breaches are everyday mistakes. A compact training session built around cases from your own business achieves more than any policy sitting in a binder. Since 2025/26, AI topics belong here too, for example what employees may enter into AI tools and what they may not. More on that on the page AI and the AI Act.
Which data protection deadlines does an SME need to know?
Two deadlines should be known in the business. Requests from data subjects, for example for access or erasure, have to be answered without delay and in any case within one month of receipt (Art. 12(3) GDPR, source: wko.at, in German, as of 9 October 2026). A data breach has to be reported to the data protection authority as soon as it is identified. If you do not report within 72 hours, you have to give reasons for the delay (Art. 33(1) GDPR, source: wko.at, in German, as of 6 October 2026). For both cases it makes sense to decide in advance who in the business is responsible.
How much effort is data protection for an SME?
GDPR for an SME means: set it up properly once, document it leanly, update it annually. The effort is manageable, the alternative (a complaint, a data breach without processes in place, lost trust) is not. What I take on in such a project is described on the page Data Protection & Compliance, and project examples are listed under data protection references.
Frequently asked questions about data protection for SMEs
What do SMEs need to consider for data protection?
The obligations do not differ by company size, only the effort scales: a record of processing activities, data processing agreements with every provider, a privacy policy that matches the technology actually in use, technical and organisational measures, and trained staff. Whether a data protection officer is additionally required depends on the nature and scope of the processing, not on headcount alone.
Does an SME need a data protection officer?
As a rule, no. According to the Austrian Economic Chamber (WKO), appointing one is only mandatory if the core activity of the business is the large-scale, regular and systematic monitoring of individuals, or the large-scale processing of sensitive data or data on criminal convictions. Headcount is not a criterion (Art. 37(1) GDPR, source: wko.at, as of 9 October 2026).
What does a GDPR consultant do for a small business?
Data protection consulting for an SME covers the inventory, the records of processing activities, the legal bases, preparing the data processing agreements with providers, bringing the privacy policy in line with the website, documenting the technical and organisational measures and training the staff. After that, an annual update is usually enough. It is not legal advice.
Is data protection different for mid-sized companies than for small ones?
No, the obligations are the same. With size, the number of processing operations, providers and employees to be trained goes up. From 250 employees the exemption from the records of processing activities no longer applies at all, although smaller businesses can hardly use it in practice either.
When does the GDPR apply to my company?
As soon as personal data is processed, meaning customer, employee or supplier data. There is no minimum headcount: sole traders are covered too.
Are records of processing activities mandatory for SMEs?
Yes. The records of processing activities under Art. 30 GDPR are mandatory in principle. The exemption for businesses under 250 employees almost never applies in practice, because regular processing such as customer and staff data cancels it out.
When do I need a data processing agreement?
Whenever a service provider processes personal data on your behalf, for example hosting, email, accounting software or cloud storage. The legal basis is Art. 28 GDPR; for providers outside the EU, also check an adequacy decision or standard contractual clauses.
What belongs in a website privacy policy?
The services actually in use, their purposes and legal bases, the data subject rights and the route for complaints to the supervisory authority. It must reflect the real state of the site, not boilerplate for services that are not there.
How long does GDPR implementation take in an SME?
It is not a year-long project. With a clean inventory and a few structured steps the core is achievable in a manageable time; after that, an annual update is enough.
Sources used: Regulation (EU) 2016/679 (GDPR) on eur-lex.europa.eu, Articles 12, 30, 33 and 37, retrieved on 13 October 2026. In addition wko.at, section DSGVO4KMU (pages on records of processing activities, data protection officers, data subject rights and data breaches, in German, as of 6 to 9 October 2026). This article was last updated in October 2026.
Note: This article is a practitioner's assessment and does not constitute legal advice for an individual case.