GDPR for small businesses: what you need to do, in brief and without a lawyer

GDPR scares many business owners, but for a small company the basic rules are simple. You don't need a legal department to be compliant. Here is what really matters, in plain language.

What GDPR is, in brief

It is the European regulation that says you must handle people's personal data with care: name, email, phone number, address. In practice, it means asking only for the data you need, keeping it safe and not using it for other purposes.

What you need on your website

• A clear privacy policy that explains what data you collect and why.
• Explicit consent on forms: a tick box through which the person agrees, not consent that is assumed.
• A cookie banner with the option to refuse, not just to accept.
• A way for people to request that their data be deleted or changed.

What you need to do within your company

• Collect only the data you really need.
• Don't sell it or pass it on without consent.
• Keep it safe: restricted access, passwords, backups.
• If a data breach occurs, it must be reported.

Common mistakes

The most frequent problems are forms without a consent tick box, no privacy policy and tracking cookies switched on before the person has accepted. They are easy to fix if the website is built properly from the start.

At AI Soft we build websites with GDPR in mind from day one: explicit consent, legally sound policies and cookies kept under control. If you'd like your website checked, write to us below.