GDPR checklist for small businesses: 15 things to have in place

By the Privacyboard teamPublished 8 October 2026Updated 4 November 20267 min read

Short answer

A small business should be able to show 15 things: a map of the personal data it holds, a legal basis for each use, a privacy policy, a processing record where required, signed vendor contracts, a way to answer requests within one month, security measures, a breach process, and a cookie banner that works.

The GDPR applies to small businesses as much as to large ones, but it does not ask for the same effort. It asks you to know what personal data you hold, to have a reason for each use, to tell people about it, and to be able to show what you did. This checklist turns that into 15 items, grouped by topic, each with the reason and the article behind it.

It is a starting point, not legal advice. Work through it once, write down what you decided, and put a review date in your calendar.

It applies if you have an establishment in the EU, or if you are outside the EU and offer goods or services to people there, or monitor their behaviour in the EU (Article 3 of the GDPR). Free services count. A small online shop in Canada that sells to customers in France is in scope. A local bakery in Ohio with no EU customers is not.

The same article is the reason some non-EU businesses must appoint a representative in the EU (Article 27), except when their processing is occasional, low risk and does not involve large-scale sensitive data.

#The 15-point checklist

#Know your data

Map the personal data you hold. List what you collect, from whom, where it is stored and who can see it. Why: every other item depends on it, and Article 5(2) says you must be able to demonstrate compliance. A shared spreadsheet is enough to start. See the guide to the record of processing activities.
Collect less and keep it for less time. Remove fields you do not use and set a retention period for each category. Why: data minimisation and storage limitation are principles in Article 5(1)(c) and (e), and data you no longer hold cannot leak.

#Legal basis and transparency

Choose a legal basis for each purpose. The six bases are consent, contract, legal obligation, vital interests, public task and legitimate interests (Article 6(1)). Why: processing without one is unlawful. Sensitive data such as health or beliefs needs an additional condition under Article 9.
Publish a privacy policy. It must say who you are, why you use the data, on what basis, who receives it, how long you keep it, and what rights people have (Articles 13 and 14). Why: people must be told, in plain language, at the time you collect their data. Read what to include in a GDPR privacy policy.
Use consent only where it is the right basis, and keep proof. Consent must be freely given, specific, informed and unambiguous, and you must be able to show it was given (Article 7(1)). If you offer an online service directly to children, the default age of consent is 16, and member states may lower it to no less than 13 (Article 8).

#Documents

Keep a record of processing activities if you need one. Article 30(5) exempts organisations with fewer than 250 people, unless the processing is likely to risk people's rights, is not occasional, or includes sensitive data. Why: most businesses that process customer or employee data regularly fall outside the exemption.
Decide whether you need a data protection officer or an impact assessment. A DPO is mandatory for public bodies, for large-scale regular and systematic monitoring, and for large-scale sensitive data (Article 37(1)). A data protection impact assessment is required before processing likely to result in a high risk (Article 35). Why: most small businesses need neither, but you should be able to explain why.
Write down your basic rules. A one-page internal policy covering access, retention, deletion and who to call in an incident is proportionate for a small team (Article 24(2)). Why: it makes your answers consistent when someone is on holiday.

#Vendors and transfers

List your vendors and sign a data processing agreement with each processor. Any provider that handles personal data on your behalf needs a contract with the terms of Article 28(3). Why: you remain responsible for what your processors do. See data processing agreements explained.
Check where data goes outside the EEA. A transfer to a third country needs an adequacy decision (Article 45), appropriate safeguards such as standard contractual clauses (Article 46), or another listed basis. Why: transfer rules are among the most heavily fined (Article 83(5)). See international data transfers.

#People's rights

Have a process for requests. People can ask for access, correction, erasure, restriction, portability and objection (Articles 15 to 22). You must answer without undue delay and within one month (Article 12(3)). Why: the clock starts on receipt, whichever mailbox it lands in. See how to respond to a data subject access request.

#Security and breaches

Apply security that fits the risk. Article 32 mentions pseudonymisation and encryption, the ability to keep systems available and restore access, and regular testing. For a small team this means strong unique passwords, two-factor authentication, updates, backups and access limited to those who need it.
Be ready for a breach. Notify the authority within 72 hours of becoming aware unless the breach is unlikely to risk people's rights (Article 33), tell the people affected when the risk is high (Article 34), and record every breach (Article 33(5)). See the 72-hour rule.

#Cookies and website

Ask before setting non-essential cookies. Under Article 5(3) of the ePrivacy Directive, analytics, advertising and most third-party embeds need consent before they run. Why: a banner that appears while trackers already load does not meet the rule. See GDPR cookie consent requirements.
Keep a record of cookie choices and re-check your site. Log each choice with the date and the banner version, and re-scan the site regularly, because new scripts and embeds appear without anyone deciding to add them. See how to find every cookie and tracker on your website.

#What to keep, and how often to review it

The GDPR does not set review dates for most documents, so the frequencies below are suggestions for a small business. Adjust them to how fast your tools and activities change.

What to keep	What it contains	Suggested review
Data map or processing record	Purposes, data categories, recipients, retention, transfers	Every 6 to 12 months, and when you start a new activity
Privacy policy	What you tell people (Articles 13 and 14)	Every 6 to 12 months, and after any new tool or purpose
Vendor list and contracts	Who handles data, their role, where they store it	Every 6 months, and when you add or drop a tool
Cookie inventory and banner text	Every cookie and tracker, with purpose and duration	Monthly check, and after any site change
Consent log	Choice, date, banner version	Kept as long as the consent is relied on
Request log	Date received, identity check, reply, outcome	Continuous; review the process yearly
Breach register	Facts, effects, action taken, decision to notify or not	Add on every incident; review lessons yearly
Security measures	Access rights, backups, updates, two-factor authentication	Every 6 to 12 months

#What happens if you skip items?

Authorities can issue warnings, orders and fines. Under Article 83, infringements of obligations such as records, security and breach handling can reach EUR 10 million or 2% of worldwide annual turnover, and infringements of principles, consent, people's rights and transfer rules can reach EUR 20 million or 4%, whichever is higher in each case. Those are ceilings, not typical amounts: authorities weigh the size of the business, the harm and your cooperation. See GDPR fines in numbers.

#A simple order to work in

If the list feels long, take it in this order:

Items 1 to 4: know your data and tell people about it.
Items 9 and 11: contracts with vendors and a request process.
Items 14 and 15: the cookie banner and a check of what your site really loads.
Items 12 and 13: security and a breach routine.
The rest, once the foundations are in place.

Tools can keep the documents in one place. Privacyboard, for example, holds the privacy policy, vendor list, processing register, request log, incident register and cookie banner in one workspace. Whatever you use, the decisions and the review are yours.

#FAQ

Yes, if the GDPR applies to them under Article 3. There is no general exemption for small businesses. The one partial relief is the record of processing activities, which has a size-based exemption with conditions (Article 30(5)).

#Do I need a data protection officer?

Usually not. A DPO is required for public bodies and for organisations whose core activities involve large-scale regular and systematic monitoring or large-scale sensitive data (Article 37(1)). You can appoint one voluntarily.

Map the personal data you hold: what, from whom, why, where it is stored and who receives it. The privacy policy, the vendor list, the processing record and your answers to requests all draw on that map.

The GDPR does not fix a date, but Article 24(1) requires measures to be reviewed and updated when necessary. A review every 6 to 12 months, and whenever you add a tool or a purpose, is a reasonable routine.

#Does a checklist make me compliant?

No. A checklist helps you cover the main obligations, but compliance depends on what you actually do and on your particular situation. For complex or high-risk processing, ask a professional.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.