XnMark insights
GDPR for small businesses: EU compliance checklist 2026
Business Owner Insights · European Union
A GDPR checklist for small business teams should cover personal data, lawful grounds, privacy information, suppliers, security and individual rights. In 2026, the normal rights-response deadline remains one month [3]. Use the checklist below to assign an owner and evidence to each task, then investigate obligations specific to your activities.
By Satya P Rai · Updated: 12 October 2026
Audience: small business owners. EU/EEA GDPR operations; UK guidance is separately identified. Legal guidance checked 12 October 2026. This is an operational starting point, not a compliance certification.
- 1 month — 2026 normal rights-response deadline [3]
- 72 hours — 2026 notifiable breach deadline after awareness [4]
- 250 employees — 2026 record-keeping exemption threshold; exceptions apply [1]
- 34 million — 2025 EU SMEs reported in the 2026 review [7]
What does GDPR require from a small business?
Small businesses must protect personal data and demonstrate how they do so; size alone does not remove the obligation. In the guidance checked in 2026, the exemption for organisations with fewer than 250 employees has important exceptions, including regular processing [1]. Start with your actual customer, employee and supplier data flows.
| Metric | Figure or scope | Year | Source |
|---|---|---|---|
| Rights requests | Normally one month | 2026 | [3] |
| Notifiable breaches | Within 72 hours of awareness | 2026 | [4] |
| Records exemption | Fewer than 250 staff; conditional | 2026 | [1] |
| Small business population | 34 million EU SMEs | 2025 | [7] |
| UK operations | Check UK GDPR separately | 2026 | [8] |
In my published work, I describe a framework for multi-market content that combines local context, compliance requirements and human review [9]. The same discipline is useful here: check what each form and supplier actually does, rather than copying another business’s privacy notice.
Where could your data protection process be breaking down?
A practical warning sign is a customer request that nobody knows how to answer. The EDPB’s guidance checked in 2026 sets a normal response period of one month [3]. Trace the request from inbox to data retrieval, and use this diagnostic to decide which part of your process needs attention.
| Symptom | What it means | Where to go |
|---|---|---|
| Unclear form fields | Purpose and necessity need review | Action plan |
| Unknown supplier access | Data flow and contracts need checking | Checklist |
| Shared login credentials | Access ownership is unclear | Action plan |
| No incident contact | Breach escalation needs assigning | Checklist |
How should you turn the GDPR checklist into an action plan?
Plan around your business activities and keep evidence of each decision. The EDPB explains six core data-protection principles in its guidance checked in 2026, alongside accountability [2]. Translate those principles into named tasks for your forms, customer database, staff records and suppliers, with a practical way to check that changes work.
Map collection points
Record what each form collects, why it is needed and where it goes.
Review purposes and suppliers
Check supplier access and written terms [5]; retain approval and deletion evidence.
Secure access and recovery
Use separate accounts, appropriate authentication and tested backups [6].
Apply human review
My published framework includes compliance and human QA [9]. Apply that discipline to personal-data workflows.
Track completion
- Assign an owner.
- Link evidence.
- Record gaps.
- Set actions.
- Check implementation.
- Schedule review.
What belongs on your one-page GDPR checklist?
Include the decisions and response procedures your team must be able to demonstrate. In 2026, a controller must notify a reportable personal data breach within 72 hours of awareness, unless it is unlikely to create risk for individuals [4]. Keep your incident contact and regulator route available before an incident occurs.
- Map personal data and flows [2].
- Document lawful grounds [2].
- Explain collection and use [3].
- Review suppliers and transfers [5].
- Limit retention and access [5].
- Test security and recovery [6].
- Prepare rights requests [3].
- Assess and document breaches [4].
Assign an owner and evidence link to each item. See our France market insight for wider customer context.
How can you use the downloadable GDPR checklist?
Download the checklist and review it against the tools and processes your business actually uses. Keep the normal one-month rights-request deadline visible in your 2026 response procedure [3]. Mark gaps, assign owners and link evidence; use the completed sheet as a work tracker, then seek specialist advice for unresolved legal questions.
Which GDPR questions do small business owners ask?
Small business owners need to distinguish broad GDPR duties from conditional obligations such as appointing a data protection officer. The European Commission’s guidance checked in 2026 explains that the fewer-than-250-employees records exemption has exceptions [1]. The answers below clarify scope and workflow without treating business size as a blanket exemption.
Does GDPR apply to very small businesses?
Yes, GDPR can apply to a very small business that processes personal data within its scope. The European Commission’s guidance checked in 2026 says application depends on activities, rather than company size [1]. Review your establishment, customers and processing purposes before deciding which obligations apply to your organisation.
Does a business with fewer than 250 employees need processing records?
It can do: the fewer-than-250-employees exemption is conditional in the European Commission’s guidance checked in 2026 [1]. Regular processing, risks to individuals, sensitive data and criminal records can trigger record-keeping duties. Routine customer or employee processing therefore needs a scope check rather than an automatic exemption claim.
How quickly must a business answer a GDPR request?
The normal response period is one month, according to EDPB guidance checked in 2026 [3]. Complex requests may justify additional time under the stated conditions, but you must inform the individual within the initial period. Keep a request log, an assigned owner and a documented response process.
Must every personal data breach be reported to the regulator?
No: controllers must document breaches, but regulator notification is not required when risk to individuals is unlikely. The EDPB guidance checked in 2026 gives a 72-hour deadline after awareness for reportable breaches [4]. Assess the incident promptly, record the reasoning and separately consider whether affected people must be informed.
Which official sources support this GDPR checklist?
The checklist uses the European Commission and EDPB’s official guidance, checked in 2026, including the normal one-month rights-request period [3]. The SME population reference supplies economic context only, and the UK regulator link applies to UK operations. The author’s profile supports the disclosed workflow experience, without establishing a legal qualification.
- European Commission: Application of the GDPR — Business scope and conditional SME obligations. Tier 1.
- EDPB: Data protection basics — Personal data, purposes and core principles. Tier 1.
- EDPB: Respect individuals’ rights — Rights-request procedures and response periods. Tier 1.
- EDPB: Data breaches — Controller and processor incident obligations. Tier 1.
- EDPB: Be compliant — Privacy by design, records and impact assessments. Tier 1.
- EDPB: Secure personal data — Security measures proportionate to processing risk. Tier 1.
- European Commission: SME Performance Review — EU SME population context; not a GDPR exemption source. Tier 1.
- ICO: Advice for small and medium organisations — Separate starting point for UK data-protection operations. Tier 1.
- Satya Prakash Rai: Published professional profile — Self-reported multi-market content framework; not regulatory evidence. Author disclosure.
Source values were checked on 12 October 2026. This checklist covers EU/EEA GDPR; national rules and individual circumstances require a separate review. Explore related European market research.