What does a small business have to do for GDPR?
A record of processing (which data, why, for how long), a notice to the people whose data you process (customers, staff, CCTV) and an answer to their requests within a month. On your website a privacy notice, and non-essential cookies only with consent. Checked by your national data protection authority (in Croatia: AZOP).
- Who must?
- Anyone who processes personal data: a customer database, employees, CCTV, a website with forms.
- What to do?
- Write the record of processing (use your authority's template; in Croatia AZOP's).
- Publish the processing notice: in your premises, on your website, next to cameras.
- Decide how you answer requests (access, erasure) within a month.
- Where to file?
- Nothing is filed; you keep the documentation. A data breach is reported to the authority within 72 hours.
- Who checks?
- National data protection authority (in Croatia: AZOP)
- Fine
- Up to 20 million € or 4 % of annual turnover, depending on severity (art. 83 GDPR).
- What if I am already late?
- Start with the record of processing and the notice; it is a day's work with the templates.
What gets said wrong online
Wrong: "A small business does not need GDPR."
Right: GDPR applies to everyone who processes personal data, whatever their size. Small businesses have no data protection officer, but they do keep a record of processing and a notice.
Sort it out
The free solution comes first, then tools. Nobody calls you.
- Regulation (EU) 2016/679 (GDPR), art. 13, 30 and 83, read on 24 Oct 2026
- AZOP: guidance and templates (Croatian)
Author: 3D&TECH LAB d.o.o. editors · Version 1
This is not legal advice. Deadlines and fines come from the sources listed; check the source before you decide.