GDPR checklist for a small business

What it works out

Most GDPR checklists hand a five-person studio the same list as a bank. This one starts from 17 duties and sizes them to the firm: a few answers decide which lines apply, which drop off, and which turn into a short dated note showing you checked. Each line that stays names the proof a supervisory authority would ask to see, because GDPR’s accountability rule (Art. 5(2)) is about being able to demonstrate compliance, not about believing it. You end with an index for an evidence binder: one tab per line, where its proof is filed and when someone last read it.

It assumes GDPR reaches the business. If you are outside the EU, test that first with which privacy laws apply to my business.

How to use this checklist

1. Answer part 1 for the business as it runs today, not as the policy says it runs. Then tick the high-risk signs your riskiest processing shows.
2. Read the reason on each line in part 2. If a reason does not match your business, an answer is wrong; fix the answer, not the line.
3. For each line, mark how much proof exists, type where it is filed (a folder path or a link) and the date someone last read it.
4. Choose a review cycle. Proof older than the cycle is flagged, so last year’s notice does not pass as current.
5. Print part 3 as the binder’s first page, or copy it into the tracker your team already uses. The “off your list” reasons print with it.

Worked example: the recruitment agency

The tool opens on a 24-person recruitment agency in Utrecht. It finds candidates on public profiles, keeps a talent pool on consent, and runs an applicant tracking system hosted in the US. Its answers keep 13 of 17 lines, 2 of them as decision records, and drop 4. Proof is on file for 5.

Three results surprise owners. The record of processing stays although the agency is far under 250 persons: the Article 29 Working Party’s position paper on Art. 30(5) gives a small firm’s regular processing of its own employees’ data as the example of processing that is not occasional, and only occasional processing is exempt. The data map template builds that record. Scoring candidates is one high-risk sign, so the DPIA turns into a dated note rather than a full assessment; add a second sign, such as matching candidate data with another source, and the privacy impact assessment template becomes the next job. And the US-hosted system puts transfers on the list: check whether the supplier is on the Data Privacy Framework List, or that its processor agreement carries the standard contractual clauses.

Why each line asks for proof, not a tick

GDPR puts the burden on the business. Art. 5(2) makes the controller responsible for, and able to demonstrate, compliance with the principles; Art. 24(1) asks for measures that ensure it and show it. Several duties are written as documents outright: the Art. 30 record must be in writing and made available to the supervisory authority on request, Art. 7(1) says you must be able to show that a person consented, and the breach log in Art. 33(5) exists so the authority can verify you handled each breach properly, including the ones you did not report. A tick in a spreadsheet proves none of that. The document behind it does.

The same logic covers the duties you do not have. The Article 29 Working Party’s DPO guidelines recommend documenting the analysis that led to no DPO, unless the answer is obvious, and updating it when the business takes on new activities; its DPIA guidelines ask a firm that finds a high-risk sign but skips the assessment to justify and document why. That is why two lines can turn into dated notes instead of dropping off. The guide to what a data protection officer does covers the three triggers in full.

The money follows the paper: records, security, breach notice, DPIAs and DPOs (Arts 25 to 39) sit in the lower fine tier, up to EUR 10 000 000 or, for an undertaking, up to 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4)). When the binder outgrows a shared drive, the GDPR compliance software comparison measures tools on the same records, requests, DPAs, DPIAs and breach log.

Jurisdiction notes

The member states

The text is the same across the EU, but three lines on this list lean on national choices. The age for a child’s own consent online is 16 unless a member state lowers it, never below 13. Member states may add conditions for genetic, biometric and health data. And each supervisory authority publishes its own list of processing that always needs a DPIA, so check your authority’s list before you file a “no DPIA” note.

Iceland, Liechtenstein and Norway

The GDPR was incorporated into the EEA Agreement by an EEA Joint Committee decision of 6 July 2018, so a firm in these three countries carries the same list, and data moving to them is not a transfer out of the EEA.

The United Kingdom and transfers

The UK runs its own UK GDPR; a firm caught by its Art. 3(2) names a representative in the United Kingdom, a separate line from the EU one. Data can flow from the EU to the UK under the Commission’s adequacy decision, renewed in December 2025. The Commission’s adequacy list also covers, among others, Canada (commercial organisations), Japan, Switzerland and the United States for organisations participating in the EU-US Data Privacy Framework. Anywhere else, the usual tool for a small firm is the Commission’s standard contractual clauses of 4 June 2021 (Art. 46(2)(c)).

Questions