GDPR guide for SMEs: practical steps

Beyond theory, here are the concrete actions your SME must implement to be truly GDPR compliant. GDPR, 7 years on: where are you?: In force since May 2018, GDPR is often seen as a distant administrative constraint. Yet the CNIL is intensifying SME inspections and fines are increasing. In 2024, 42% of CNIL sanctions targeted structures with fewer than 250 employees. The 5 fundamentals to check: 1) Processing register: have you documented what data you collect, why, and how long you keep it? 2) Consent: do your forms collect explicit, granular consent? 3) Sub-processors: do you have GDPR clauses in your contracts? 4) Data subject rights: can you respond to an access or deletion request within 30 days? 5) Security: is your data encrypted and backed up? GDPR and AI: the new challenge: Using AI tools adds complexity: where does data injected into ChatGPT go? Does your CRM's predictive scoring constitute profiling? The AI Act and GDPR complement each other. Tools to simplify compliance: Several open source tools facilitate compliance: online processing registers, privacy policy generators, consent solutions. At Powehi, we integrate GDPR compliance from the design stage (privacy by design). Keep evidence with each process: For every processing activity, keep a practical record of its purpose, data categories, systems, recipients, retention rule and responsible contact. Note which suppliers handle the data and where their current terms and security information can be found. When a form, tool or workflow changes, review the record and the information shown to users. Define an internal route for access, correction or deletion requests, and make sure the team knows where to escalate uncertain cases. This evidence helps staff explain how a process works; it does not replace a legal review where one is needed.