GDPR in a Small Business: Clients, Employees, and Data Processing Agreements

A small business collects data from clients, collaborators, and employees, using email, accounting, or order management systems. GDPR is not just about placing a single document on the website. It is essential to know what data is being processed, for what purpose, who has access to it, and on what basis.

Status checked: November 2, 2026. We are not a law firm. This material is for informational and educational purposes and does not constitute individual legal advice. Appropriate actions depend on the company's activities, the type of data, risks, and relationships with suppliers. In case of doubts, consult a specialist.

Data Controller and Processor

The data controller determines the purposes and means of processing data. The processor carries out these tasks on behalf of the controller. The name of the service or merely issuing an invoice does not determine the role: it is necessary to investigate who decides what and what data is used. The Personal Data Protection Office (UODO) cites cooperation with an accounting office and an IT company as examples where data processing may occur. Not every transfer of data to another entity constitutes processing.

Example: a company outsources payroll processing to an external service provider, who processes specific data at its request. In such a case, the obligation of the contract under Article 28 of GDPR should be assessed. Conversely, transferring required data to a public authority based on a regulation does not automatically mean that the authority is the company's processor. UODO explanations.

Data Inventory and Legal Bases

1. List the processes: orders, accounting, employment, recruitment, contact, monitoring, and marketing, if the company conducts them.
2. For each, note the purpose, categories of data and individuals, source of data, recipients, and systems used for work.
3. Establish the legal basis for each specific purpose. Consent is not the only basis: for example, the performance of a contract or a legal obligation may require separate assessment.
4. Determine the retention period or criteria for establishing it. Record who has access and when rights are revoked.
5. Check if and what record of processing activities is required, and whether a further risk assessment needs to be conducted.

Information for Clients and Employees

Information about processing should be available in a timely manner and correspond to the actual processes of the company. Articles 13 and 14 of GDPR specify the scope of information depending on how the data was obtained. This may include, among others, the identity of the controller, purposes, legal bases, recipients, retention periods, and the rights of the individual. Copying a ready-made policy without checking its content does not document the company's compliance.

The company should be able to accept and address requests regarding data, such as access or rectification. Rights and exceptions depend on the request and the basis for processing. Train individuals receiving such requests, establish a method for verifying identity, and passing the matter to the responsible person.

Agreements with Suppliers

If the supplier acts as a processor, choose a service that provides appropriate guarantees and check the documentation required by GDPR. Article 28 specifies the elements of the agreement, including the subject and duration of processing, nature and purpose, type of data, categories of individuals, and obligations of the parties. The role of subcontractors, support in incidents, the possibility of verification, and the return or deletion of data after the service ends are also significant. UODO on the obligations of controllers and processors.

Check where the data is processed and whether there is a transfer outside the European Economic Area. Simply purchasing an online service does not replace the analysis of transfers, security measures, or contract conditions.

Security and Breaches

Choose security measures according to the risk: limit access to those who need it, apply appropriate authentication, updates, and backups. Establish a procedure for loss of devices, erroneous dispatch, or unauthorized access. Not every incident must be reported to the authority, but each must be assessed and documented. The obligation to notify and the deadline depend on the type of breach and the risk to individuals.

Review Checklist

• The list of processes, suppliers, and systems is up to date.
• Information for individuals corresponds to reality, not just a template.
• The roles of suppliers and necessary agreements have been assessed.
• Access, retention, copies, and procedures in case of a breach have a designated responsible person.
• The company can accept a request from the data subject.

Sources