Data protection without panic

What is GDPR really?

It's a law protecting personal data. If you collect names, emails, phone numbers or addresses from customers — which every business does — the law applies to you.

What MUST you do?

• Inform — Tell customers what data you collect and why. A privacy policy on your website is enough for most.
• Have a purpose — You may only collect data you actually need.
• Protect the data — Store customer data securely. Not in an unlocked spreadsheet.
• Delete on request — If a customer asks you to delete their data, you must be able to do so.

What happens if you get it wrong?

In theory, fines can be large. In practice, authorities focus on large companies that knowingly break the law. As a small business, showing good faith and taking reasonable steps is usually enough.