GDPR Basics for Small Businesses: The Afternoon That Sorts It
14 January 2026 · Mary Molloy Solicitors
Small business GDPR advice comes in two broken flavours: enterprise frameworks scaled down until they crush the reader, and reassurance that none of it really applies. The truth is a bounded task: map the data, put four documents in place, discipline the marketing, and be able to answer a request. An honest afternoon starts it; this post is the agenda.
Hour one: the data map
List what personal data the business holds (customers, staff, suppliers, CCTV, the mailing list), where it lives (software, cloud accounts, the filing cabinet, the owner's phone), why you hold each set, and how long you keep it. The exercise surfaces the same three findings in almost every SME: data kept forever by default, business data in personal accounts, and a marketing list of archaeological origin. Fixing those three is most of real compliance.
The four documents
A plain-language privacy notice on the website and at collection points. The record of processing — the data map, kept current. A one-page staff policy covering the two fire drills: what to do when a request arrives, what to do when something leaks. Processor agreements with the services handling your data — payroll, cloud tools, IT support; reputable providers publish these as standard terms, and the task is confirming and filing them, not drafting.
Marketing and request-readiness
Electronic marketing to individuals needs consent, save the existing-customer exception for your own similar products with an opt-out offered at collection and in every message — and bought lists are where DPC complaints are born. Request-readiness is the payoff of the map: when an access request lands, you know where to look, the month is enough, and the response is procedure rather than crisis. That is the whole game at SME scale.
Read more in our main guide: GDPR for Small Business: Compliance Without the Panic · or back to the blog.
This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.