Definition (canonical)
GDPR is the EU regulation governing how organizations process personal data — any information about an identifiable person, from an email address to behavioral logs. It applies far beyond Europe: any business offering goods or services to people in the EU, or monitoring their behavior, is in scope regardless of where it sits.
The backbone: lawful basis and rights
Every processing operation needs ONE of six lawful bases — the practical trio for business: contract (data needed to deliver what the customer bought), legitimate interest (fraud prevention, direct B2B outreach — requires a documented balancing test), and consent (freely given, specific, withdrawable — the WEAKEST base, to be used last, not first; the cookie-banner theater taught companies to over-rely on it). Mapped against bases sit the data subject rights your processes must actually serve: access (a copy of their data), rectification, erasure, portability, objection — each with a one-month response clock. The operational test: could you execute a deletion request across all systems, including backups policy and your vendors, this month?
Accountability — the paper trail that decides audits
GDPR's quiet core is that you must PROVE compliance: a Record of Processing Activities (what data, why, how long, shared with whom — the map everything else hangs on), privacy notices in honest language, Data Processing Agreements with every vendor touching your data (hosting, email tools, CRM, analytics — processors work only on documented instructions), retention schedules actually executed, and DPIAs for risky processing. Cross-border reality: transfers outside the EU need a mechanism (adequacy, SCCs) — using a non-EU SaaS IS a transfer, which is why vendor lists and DPAs are the first thing regulators request.
Breaches, fines and the pragmatic program
Personal data breach = the 72-hour clock to notify the authority (and affected people, when risk is high) — the timer starts at AWARENESS, so an internal escalation path is mandatory equipment. Fines scale to 20M EUR or 4% of global turnover; enforcement reality hits mid-sized firms mostly for: no legal basis for marketing, ignored access requests, missing DPAs, and unreported breaches. A pragmatic SME program: data map, notices, DPA folder, retention calendar, breach procedure, annual review — days of work that convert an existential audit into paperwork.
FAQ
Does B2B contact data count as personal data? Yes — a work email identifying a person is in scope; legitimate interest usually carries B2B outreach, with easy opt-out.
Do I need a DPO? Only for large-scale monitoring or sensitive-data cores — but every company needs an OWNER of the topic, titled or not.
We're a small company — will anyone check? Complaints drive enforcement: one angry ex-customer or ex-employee triggers more audits than regulators' initiative — smallness is not a shield.
Related: Compliance · CRM · E-commerce Reviewed: 2026-07-16 · Sources: GDPR; EDPB guidelines