Information Security Management
GDPR for Small Businesses
GDPR can feel like a fog of legal language, policies, and “just in case” paperwork. This page is your hub for simple GDPR guidance that focuses on what small and medium organisations actually need to do.
Whether you’re trying to reduce risk, answer customer questionnaires, or simply stop worrying that you’ve missed something important, you’ll find two routes here:
- Learn GDPR: short, focused pages that explain key topics without the waffle
- Do GDPR: a practical toolkit (templates + guides) and a quick assessment to help you prioritise what matters
Learn more about the toolkit
GDPR Basics
Learning the very basics of GDPR for small-to-medium businesses.
Introduction to GDPR
A simple overview of what GDPR is, who it applies to, and what “compliance” looks like in real life.
Read the GDPR Introduction →
GDPR Principles
The seven principles that sit underneath everything, and how they show up day-to-day.
Learn the GDPR Principles →
Personal Data
What counts as personal data, special category data, and common grey areas.
What is Personal Data? →
People’s rights under GDPR
The rights people have over their data and what your organisation must be able to do.
Understand GDPR Rights →
Subject Access Requests (SARs / DSARs)
How to handle requests calmly, consistently, and within the deadline.
Subject Access Requests Explained →
GDPR Roles & Responsibilities
Exploring the various functions and key ownerships within GDPR.
The GDPR Toolkit (done-for-you templates + guidance)
If you want the quickest route to a credible GDPR foundation, the toolkit is designed for exactly that: minimal, practical compliance without turning your business into a paperwork factory.
What you get
- Ready-to-use templates: policies, procedures, logs, and registers you can actually maintain
- Implementation guidance: what to do first, what to skip, and what “good enough” looks like
- A simple structure that helps you show progress to customers, partners, and auditors
Who it’s for
- small to medium organisations that need a pragmatic GDPR baseline
- teams without a full-time Data Protection Officer
- anyone who wants to stop staring at a blank Word document thinking “where do I even start?”
What “good GDPR” looks like (for most SMEs)
For most organisations, GDPR success is not about having 70 documents. It’s about being able to show, with confidence, that you:
- know what personal data you hold and why
- keep it secure (and can evidence basic controls)
- have sensible retention and deletion habits
- use suppliers responsibly (and have the right contractual basics)
- can respond to requests and incidents without panic
That’s the thread running through the guidance pages and the toolkit.
FAQs
Does GDPR apply to non-UK or EU organisations?
Yes. If you offer goods or services to people in the UK or EU, or monitor UK or EU individuals, then potentially both UK and EU GDPR may apply.
We’re small. Do we still need all this?
Small organisations still have obligations, but the solution should match the risk. The goal is sensible, workable compliance, not bureaucracy.
Do we need a DPO?
Not always. Some organisations do, many don’t. If you’re unsure, use the assessment and then read the controllers/processors page.
Are templates enough?
Templates save time, but you still need to tailor them. I’m not pretending otherwise. The toolkit is designed to make tailoring straightforward and to prevent “policy theatre”.
GDPR Articles
Everything you need to know about getting GDPR Ready.