GDPR fines hit SMBs harder than enterprise — they don't have legal teams to absorb the blow. This checklist covers the 12 areas that data protection authorities audit first, written for business owners who handle their own compliance without a dedicated DPO.
Updated for 2026: This checklist reflects guidance from the European Data Protection Board (EDPB) updated in Q1 2026, including new requirements around AI-processed data and cross-border data transfers post-adequacy decisions.
Every type of personal data you process needs a documented lawful basis — consent, contract, legal obligation, legitimate interest, etc. Auditors ask for this first. If you can't show it for every data category, you're exposed.
Article 30 requires most organisations to keep a written record of all processing activities. It doesn't need to be complex — a spreadsheet works — but it must exist and be current. Include: what data, why, who has access, and how long you keep it.
Your privacy policy must clearly explain what data you collect, why, how long you keep it, and how people can exercise their rights. Vague or outdated notices are one of the most common findings in audits. Review it annually at minimum.
You need a documented process for handling access requests, deletion requests, and data portability requests — and you must respond within 30 days. Have a named person responsible for this and a log of requests received.
If you rely on consent as your lawful basis (e.g. for marketing emails), that consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes don't count. Keep records of when and how consent was obtained.
Every third-party service that processes personal data on your behalf — your CRM, email platform, cloud storage — needs a signed DPA. Most major vendors provide these automatically; the risk is smaller or newer tools that don't.
Review your SaaS stack annuallyYou should only collect data you actually need. Audit your forms, CRM fields, and databases for data that was collected "just in case" and either justify it or delete it. Auditors look for bloated datasets as a sign of poor data governance.
Data can't be kept indefinitely. Define how long you keep each category of data, why, and what happens when that period ends. Automated deletion policies are ideal — manual processes are error-prone at scale.
Tools: most CRMs and cloud storage platforms support retention policiesGDPR requires "appropriate technical measures" to protect personal data. This means encryption at rest and in transit, access controls, and regular security assessments. You need to be able to demonstrate these measures exist — not just claim they do.
Endpoint protection: Bitdefender or ESETIf you suffer a data breach, you have 72 hours to notify your supervisory authority. That clock starts from when you become aware. Have a written procedure that defines: who decides if a breach is notifiable, who notifies the authority, and what information is included.
Human error causes the majority of data breaches. Your team needs to know how to spot phishing, handle personal data correctly, and what to do if something goes wrong. Training must be documented — verbal briefings don't count in an audit.
See: 5 phishing emails your team will fall forIf you transfer data outside the EU/EEA — including to US-based cloud services — you need a valid transfer mechanism. Standard Contractual Clauses (SCCs) are the most common. Check whether the tools you use have updated SCCs for 2026.
Manual compliance is error-prone and time-consuming. These tools address specific areas of the checklist:
GDPR fines can reach €20 million or 4% of global annual turnover — but for SMBs, real-world fines are typically much smaller and proportionate. The most common fines for small businesses fall in the €5,000–€50,000 range for procedural failures (missing RoPA, no DPAs signed, inadequate privacy notices).
More damaging than the fine is often the reputational impact and the cost of the investigation itself — legal fees, remediation work, and potential loss of customers.
GDPR compliance for SMBs is more about documentation and process than technology. Most small businesses already do the right things — they just don't document them. Start with points 1, 2, and 6 from this checklist: lawful basis, RoPA, and processor agreements. Those three cover the majority of audit findings.