What Is GDPR? A Plain-English Guide for Small Businesses

GDPR gets mentioned constantly and explained rarely. If you run a small business and keep seeing the term without a clear sense of what it actually requires, this is the plain version: what it is, who it’s for, and the handful of things that matter most in practice.

What GDPR actually is

The General Data Protection Regulation is the European Union’s data privacy law, in force since 2018. It sets rules for how organizations collect, store, use, and share personal data belonging to people in the EU and EEA. It’s not a US law, but it applies based on whose data you’re handling, not where your business is registered, which is why it reaches far outside Europe. We cover that specific question in our piece on whether GDPR applies to a US-based site.

The core ideas, without the legal language

Strip away the legal drafting and GDPR comes down to a few principles:

• You need a reason to process personal data, and “we felt like it” isn’t one. Consent, contract necessity, and legitimate interest are the common lawful bases, we cover the consent-vs-legitimate-interest distinction specifically in our piece on that topic.
• People have rights over their own data, to see what you hold, correct it, delete it, or export it. This is the DSAR process, covered in our dedicated guide.
• You have to tell people what you’re doing, clearly, before you do it, this is where privacy policies and cookie banners come in.
• You’re responsible for your vendors too. If a third-party tool processes data on your behalf, GDPR still holds you accountable for how that data is handled.

What this means for a small business, practically

You don’t need a legal department to take a reasonable first pass at GDPR. The highest-leverage steps:

1. Know what personal data you collect and why.
2. Get consent right for cookies and marketing, opt-in, not pre-checked, easy to reject.
3. Publish a privacy policy that matches what your site actually does.
4. Have a simple process for handling a data access or deletion request if one arrives.

Where people usually overcomplicate this

GDPR compliance gets treated as an all-or-nothing legal project more often than it needs to be. In practice, most small businesses can address the majority of their exposure with a properly configured consent banner and a privacy policy that’s actually accurate, the more complex obligations (DPIAs, appointing a data protection officer, cross-border transfer mechanisms) generally only kick in at larger scale or higher-risk processing. Start with the basics covered in our full compliance checklist before worrying about the edge cases.

This guide is educational and not legal advice. For your specific situation, consult a privacy attorney.