GDPR Compliance for SMEs in Practice: Records, Security and Data Breaches

The GDPR has been in force since 2018, yet in many SMEs "being GDPR compliant" is still a box someone ticked once and never revisited. Meanwhile, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) continues to enforce the rules and the number of data breach notifications rises every year. In this article, we explain what the GDPR actually asks of a small or mid-sized business, which parts you really need to have in order, and how to get there without a privacy lawyer on the payroll.

What the GDPR asks of SMEs

The GDPR (General Data Protection Regulation, known in Dutch as the AVG) has applied since 25 May 2018. In the Netherlands, the AP supervises compliance, supported by the Dutch GDPR Implementation Act (Uitvoeringswet AVG). For SMEs, it comes down to six practical areas you need to sort out: a record of processing activities, technical security, a data breach process, clarity about data subjects' rights, agreements with your processors and retention periods that hold up.

The law works with open standards ("appropriate technical and organisational measures"), where what counts as appropriate depends on the state of the art, the nature of the data and the risk. For SME owners that is both frustrating and helpful: you don't have to do everything Shell or ING does, but you do have to be able to explain why your choices are reasonable.

What the fines really mean

Article 83 of the GDPR sets out two categories of fines. The heaviest goes up to €20 million or 4% of worldwide annual turnover, whichever is higher. The lower category is €10 million or 2%. The big fines of recent years have mainly hit large companies: €290 million for Uber (2024), €30.5 million for Clearview AI, €4.75 million for Netflix.

For SMEs the picture is more nuanced. The AP's 2024 annual report shows that the regulator imposed six fines, four orders subject to a penalty payment and seven reprimands that year, alongside more than 2,000 conversations and awareness sessions. The policy is clear: focus heavily on educating SMEs and reserve the large fines for major offenders. That is not a free pass; after a data breach or a complaint, an SME can certainly receive a reprimand or be named publicly.

The record of processing activities: almost always required

Article 30 of the GDPR says a record of processing activities is mandatory for organisations with 250 or more employees. That sounds reassuring for SMEs, but the exception is in the same provision: with fewer than 250 employees you still need a record if the processing is not occasional, poses a risk or involves special-category or criminal-offence data. In practice, almost every SME falls under that exception. If you have staff, customers, suppliers and a newsletter, your processing is not occasional.

A workable record describes, for each processing activity: which personal data, from whom, for what purpose, on what legal basis, how long it is kept, who it is shared with and how it is secured. An Excel file will do. What matters is that you keep it up to date: every time a new IT system touches personal data (CRM, payroll software, marketing platform), you extend the record. The AP has a practical step-by-step plan for SME owners (in Dutch) that includes the record as a concrete step.

Technical measures: what is "appropriate"?

Article 32 of the GDPR requires appropriate technical and organisational measures. For an SME, that translates into a fixed set of baseline measures you should have in place regardless:

• Multi-factor authentication on every account with access to personal data. This is now so standard that its absence is seen as negligent in an audit. See also our guide to implementing MFA.
• Encryption of data on laptops and mobile devices, and in transit (HTTPS, TLS for email).
• A patching policy for operating systems, applications and plug-ins. This is also a mandatory measure under NIS2, and is still missing in too many SMEs.
• Backup and recovery with a tested restore process.
• Access management that gives employees access only to the data they need for their work.
• Logging and monitoring of access to sensitive systems.

The guidelines from the Dutch National Cyber Security Centre (NCSC) on identity and access management add further detail here. The bottom line: technical measures that are standard practice for cybersecurity also count towards the GDPR. Work through your cybersecurity checklist and you'll have done much of the GDPR work at the same time.

The 72-hour data breach notification duty

A data breach is any security breach that leads to the loss of, unauthorised access to or disclosure of personal data. A lost laptop, a stolen phone, an email with customer data sent to the wrong person, a hacked mailbox. Under Article 33 of the GDPR, you must report a data breach to the AP within 72 hours of discovering it, unless it is unlikely to pose a risk to the people involved.

72 hours is not long. It means you need a simple process so that an employee who notices something suspicious knows who to report it to. It also means you must be able to establish internally whether an event qualifies as a data breach. In 2024, the AP received 37,839 data breach notifications (partly due to bulk notifications from large organisations), while the number of unique incidents rose from 5,480 in 2023 to 14,067 in 2024. The figures show that data breaches are no longer the exception for SMEs.

What to do when things go wrong is covered in our practical guide to handling a data breach. The fine for failing to report, or reporting too late, can reach €10 million or 2% of worldwide annual turnover.

Data processing agreements are not a formality

If an external party processes personal data on your behalf (think of a payroll provider, a mailing platform, a hosting company or a CRM vendor), you need a data processing agreement. Article 28 of the GDPR sets out the minimum content: purpose, duration, authority to give instructions, security, confidentiality, rules on sub-processors, support with data subjects' rights, breach notification, audit rights and what happens to the data afterwards.

Large suppliers (Microsoft, Google, payroll software) provide a data processing agreement as standard. With smaller suppliers, you'll need to ask for one. Keep the document with your record of processing activities and note what has been agreed about data location. Since Microsoft completed its EU Data Boundary on 26 February 2025, most Microsoft 365 and Azure data stays within the EU/EFTA. That helps, although the US CLOUD Act could in theory still be used to request access.

Retention periods: no longer than necessary

The GDPR does not set fixed retention periods. The "storage limitation" principle (Article 5) says: no longer than necessary for the purpose. A few common periods you can't avoid:

• Job application data: without consent, a maximum of 4 weeks after the end of the procedure; with consent, up to 1 year.
• Tax records: 7 years (Article 52 of the Dutch General Tax Act, AWR). For real estate, 10 years.
• Personnel files: in principle 2 years after the employee leaves, with exceptions for tax-related parts.
• Customer data: for as long as the customer relationship lasts, plus a reasonable period for warranty, disputes or ongoing contracts.
• Marketing data: as long as the person does not object and the purpose is active.

Where SMEs often go wrong: old files in mailboxes, data dumped on network drives, former employees still in the CRM. A quarterly clean-up means you won't have to explain after a data breach why an applicant from 2019 is still on your server.

The eight rights of data subjects

Under the GDPR, data subjects have eight rights: to be informed, of access, to rectification, to erasure, to restriction, to data portability, to object, and not to be subject to automated decision-making. In practice, this means that if an employee, job applicant or customer asks you "what data do you hold about me?", you must be able to answer within 1 month (in complex cases this can be extended by 2 months).

A workable approach: one fixed point of contact (management, HR or privacy@yourcompany.nl), a standard procedure for assessing the request, and a fixed format for the answer. The DPG Media case showed how sensitive this is: an overly strict identification requirement (a copy of ID by default) led to an AP fine, reduced to €262,500 by the Council of State (Raad van State), the highest Dutch administrative court, on 24 September 2025. Only ask for what you need to confirm someone's identity.

When is a DPIA or DPO required?

A DPIA (Data Protection Impact Assessment) is mandatory for processing that is likely to pose a high risk. For SMEs, this comes into play with things like systematic monitoring of employees (such as tracking software), large-scale processing of special-category data (health data, biometric data), or automated decision-making with legal effects. The AP publishes a list of processing types that require a DPIA (in Dutch) that you can check against.

A Data Protection Officer (DPO, in Dutch "Functionaris voor Gegevensbescherming" or FG) is mandatory for public authorities and for organisations whose core activities involve large-scale monitoring or large-scale processing of special-category data. Most SMEs are not required to have a DPO, but they can voluntarily appoint a privacy coordinator. A voluntary role does not have the legal status of a DPO and does not need to be registered with the AP.

GDPR, ISO 27001 and NIS2: avoid doing the work twice

Three compliance frameworks often get mixed up in SMEs: the GDPR (privacy), ISO 27001 (information security) and NIS2 (cybersecurity in critical sectors). They overlap considerably. If you work towards ISO 27001, you will already have covered most of the GDPR's security measures. If you set up your NIS2 programme, you once again cover much of the GDPR's security requirements.

For most SMEs, that is good news. Measures you take for cybersecurity (MFA, encryption, patching, logging, identity management) count straight away towards the GDPR. Market sources estimate that an ISMS meeting ISO 27001 overlaps 70 to 80% with NIS2 requirements. The trick is to tackle all three regimes as a whole, not as three separate projects.

Frequently asked questions about the GDPR for SMEs

Does the GDPR also apply to my sole proprietorship or small business?

Yes, the GDPR applies to every organisation that processes personal data. The difference lies in proportionality: a sole trader doesn't need to appoint a DPO or set up a complex privacy management system, but does need a record of processing activities, the ability to report data breaches and appropriate security. The AP takes the size of the business into account.

Do I need separate consent from my customers for every use of their data?

Not always. The GDPR has six legal bases: consent, performance of a contract, legal obligation, vital interests, public task and legitimate interests. You don't need separate consent to perform a sales contract. You do for marketing messages to new contacts and for cookies. Use the right legal basis for each processing activity.

What is the difference between a data breach and a security incident?

A security incident is any disruption of IT security (a phishing attempt, a blocked malware attempt). A data breach is an incident in which personal data has actually been put at risk: leaked, lost, accidentally exposed or altered by someone without the right to do so. Not every incident is a data breach, but a data breach often starts out as an incident. Good triage helps you quickly determine what you need to report.

Can I store customer data in the cloud?

Yes, provided you have the right agreements in place. The cloud provider must supply a data processing agreement, the data must be secured (encryption, MFA, access management) and you need to know where the data is stored. For Microsoft and Google, their EU Data Boundary projects have ensured since 2025 that most data stays within the EU/EFTA. Highly sensitive sectors (healthcare, government) remain subject to additional requirements under NEN 7510 (the Dutch healthcare information security standard) or sector-specific regulations.

How much does it cost to make my SME GDPR compliant?

That depends on where you are now. An SME that already has MFA, backup and modern cloud workplaces can often get its GDPR house in order for a few thousand euros of analysis and documentation. For a business starting from scratch, it can run to several tens of thousands of euros plus annual maintenance. Either way, it's cheaper than a data breach with reputational damage.

Conclusion

The GDPR is not a piece of legislation you tick off on a Friday afternoon. It is a set of baseline measures that go hand in hand with cybersecurity and need structural upkeep: an up-to-date record of processing activities, appropriate technical security, a working data breach process, clear data processing agreements and retention periods that hold up. For most SMEs the work is manageable, especially if you combine it with your cybersecurity and NIS2 programme.

Want to know where your business stands today and what the most practical next steps are? Call TRON Group on +31 85 303 5869 or take a look at our cybersecurity service. We carry out a GDPR scan, map the risks and help you put your record of processing activities, technical measures and data breach process into practice, aligned with your wider IT and NIS2 preparations.