GDPR for small businesses and associations — a practical 2026 checklist

GDPR applies to everyone — from a one-person business to an association with five hundred members. The biggest misconception is "we're too small for it to apply". It does. But for small organisations the rules are usually simpler than people think.

What GDPR actually requires — the short version

You may only collect data you have a legal basis for
You must be able to state what you hold, why, where it's stored and who has access
Users have rights to their data — copy, correction, deletion
You must protect it technically — encryption, access control, strong authentication
In case of a breach you have 72 hours to notify your supervisory authority

The checklist — 12 points

1. List the personal data you hold

Internal table: what / why / where / how long.

2. Legal basis for each category

Contract — you need the email to send the invoice
Legitimate interest — security logs
Consent — newsletters, marketing
Legal obligation — accounting law requires 6–10 years retention

3. Privacy policy on the site

1–2 pages is enough. See ours as an example.

4. Cookie banner

Marketing cookies need explicit consent. Functional cookies (session, language) can load without consent. Google CMP or Cookiebot handle this.

5. Secure handling

No shared accounts
2FA wherever possible
No personal data in email attachments — use a secure portal link
Password manager for the team

6. Data Processing Agreements (DPA)

You need a DPA with every external service that holds customer data. Most modern SaaS providers offer click-through DPAs.

7. Plan for data requests

You have 30 days to respond. Prepare a process: who receives the email, how to export the data, response template.

8. Breach response plan

Within 72 hours: notify your supervisory authority, inform affected parties if high risk, document.

9. Delete what you don't need

Invoice data: legal retention period (6–10 years EU)
Inactive members: 1–3 years
Marketing recipients: max 12 months without interaction
Logs: 30–90 days

10. Member registers (associations)

The member register is needed to fulfil the membership contract. Only keep what's relevant — name, contact details, membership category. No national IDs unless necessary.

11. Backups and deletion

You must be able to actually delete data, including backups. 30–90 days rolling backup is normal.

12. Document everything

GDPR has an accountability requirement: you must be able to show you comply. A simple internal policy file is enough.

How 1invoice.online helps

EU hosting (Supabase Frankfurt)
Encrypted storage + TLS 1.3
Row-level security — no cross-tenant access
One-click export to CSV+JSON ZIP
Magic-link login — no passwords to leak

Create a free account and tick off several points today.