The most common mistake
Small and medium-sized businesses often assume that the GDPRGeneral Data Protection Regulation: a European rule that defines how companies must collect, process, and protect personal data. does not apply to their scale of operation, which is a mistake. A basic register of processing activities, an adequate privacy policy, and contracts with data processors are the minimum required, regardless of the size of the business.
Three steps to get started
Mapping which personal data the company actually processes, reviewing contracts with suppliers who also access that data, and preparing a simple procedure for responding to data subject requests are, in practice, the most realistic starting point for most SMEs.
© 2026 Horacio Baptista Ladera. All rights reserved. Reproduction prohibited without prior authorization.
