GDPR Explained Simply
What the GDPR actually asks of a small business, in plain English — lawful bases, user rights, cookies, and the parts people get wrong.
The General Data Protection Regulation is the EU's data protection law, mirrored almost word for word by the UK GDPR after Brexit. It applies to you if you are established in the EU or UK, or if you offer goods and services to, or monitor the behaviour of, people who are there. Running Google Analytics on a site that gets EU visitors counts as monitoring.
Most of the regulation is aimed at large organisations. For a small business, the working set is smaller than the reputation suggests: have a reason for collecting each thing, tell people about it, keep it secure, honour their requests, and be able to show your reasoning.
The lawful basis question is the one that matters
You cannot process personal data without a lawful basis from Article 6. In practice small businesses use three. Contract covers what you need to fulfil an order — you do not need consent to email someone their receipt or ship their parcel. Legitimate interests covers things like fraud prevention, security logging and, in some cases, business-to-business outreach, provided you have weighed your interest against the person's rights. Consent covers marketing email and non-essential cookies, and it must be a freely given, specific, unambiguous opt-in that you can withdraw as easily as you gave.
Two consequences follow. A pre-ticked newsletter box on a checkout is not consent. And if you claim consent as your basis, you must be able to delete on request without arguing about it — so do not use consent where contract or legitimate interests genuinely fit better.
Rights you have to be able to honour
Access, rectification, erasure, restriction, portability, objection, and the Article 22 right not to be subject to solely automated decisions with legal or similarly significant effects. You have one month to respond, extendable to three for complex cases, and you cannot charge for a first request.
Set this up before you need it. Know where the data lives — your ecommerce platform, email tool, CRM, support inbox and backups — and write down how you would export or delete a person from each. That note is most of your Article 30 record of processing.
Cookies are a different law
Cookie consent comes from the ePrivacy Directive, not the GDPR, although GDPR's consent standard applies to it. The rule is that you may set strictly necessary cookies without consent, and everything else — analytics, advertising, embedded video, A/B testing, session recording — needs prior opt-in. 'Prior' is the part banners get wrong: if your analytics script fires before the visitor clicks anything, the banner is decoration.
Processors, transfers and breaches
Every vendor that touches personal data on your behalf is a processor and needs a data processing agreement, which the major platforms publish and you accept in their terms. If a processor stores data outside the EEA or UK, you need a transfer mechanism — usually the Standard Contractual Clauses, or the EU-US Data Privacy Framework where the vendor is certified — and your policy should say transfers happen and how they are safeguarded.
A personal data breach that risks people's rights must be reported to your supervisory authority within 72 hours of becoming aware, and to the affected people if the risk is high. Knowing which authority applies to you in advance saves a bad day.
What to actually do this week
List every tool that receives visitor or customer data. Write a lawful basis next to each purpose. Publish a policy that names those tools and those bases. Fix your cookie banner so non-essential scripts wait for consent. Decide who handles a rights request and how.
This is general information rather than legal advice; a lawyer in your jurisdiction should review high-risk processing such as health data, profiling or large-scale tracking.