{"id":3769,"date":"2018-02-13T15:47:07","date_gmt":"2018-02-13T15:47:07","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/?p=3769"},"modified":"2025-12-05T11:32:13","modified_gmt":"2025-12-05T11:32:13","slug":"gdpr-guide-small-businesses","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/gdpr-guide-small-businesses\/","title":{"rendered":"GDPR for small business: A quick-start guide"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tStrategy, Legal & Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tGDPR for small business: A quick-start guide\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\t
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"\"\t\t\t\tKeir Thomas-Bryant<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n\n\n

Believe it or not, it was just 100 days as of Valentine\u2019s Day until the GDPR comes into force on 25 May 2018. Whether you\u2019ve fallen in love with GDPR or not, you might want to use this as a milestone to measure how well your GDPR preparations are progressing.<\/p>\n\n\n\n

For example, you might want to tune into one of our GDPR webinars to better understand the legislation and what GDPR means for small businesses.<\/p>\n\n\n\n

GDPR and small business<\/strong><\/h2>\n\n\n\n

However, below are some headline examples of how GDPR will affect the typical functions and\/or departments of a small business, with the following caveats. Firstly, this is not an exclusive list and nor is it a substitute for receiving legally qualified advice or examining your own procedures and methods in depth (see the Sage Legal Disclaimer at the end of this piece).<\/p>\n\n\n\n

Secondly, at the time of writing the exact impact of the GDPR<\/a> isn\u2019t yet known. For example, we lack practical examples of what agencies such as the Information Commissioner\u2019s Office<\/a> are likely to find acceptable or objectionable, and some of the wording of the GDPR legislation is open to interpretation.<\/p>\n\n\n\n

Therefore, what\u2019s detailed below can only be considered as educated guesses at the very best. This is what GDPR means for small business…<\/p>\n\n\n\n

\n
<\/video><\/div><\/div>\n<\/div><\/figure>\n\n\n\n

Sales and marketing<\/strong><\/h2>\n\n\n\n

The GDPR\u2019s new, stronger requirements for consent can hit marketing and customer processes in a particularly harsh way.<\/p>\n\n\n\n

Existing marketing data<\/strong><\/h3>\n\n\n\n

Put simply, with existing databases for marketing leads you will have to undertake two tasks, at least, prior to the GDPR\u2019s implementation:<\/p>\n\n\n\n

    \n
  • Legally review the consent that was used originally and see if it\u2019s compatible with the GDPR\u2019s requirements.<\/li>\n\n\n\n
  • In the likely event that your existing consent isn\u2019t sufficient, and there\u2019s no other basis for lawful processing of the data, you will have to contact each and every one of the individuals in the database to seek new consent. If you don\u2019t receive fresh and specific consent for the ways in which you\u2019d like to process the data then that individual\u2019s data must be suppressed or deleted.<\/li>\n<\/ul>\n\n\n\n

    It\u2019s been estimated that the above requirements could mean databases such as those for sales and marketing are reduced by as much as three quarters. However, it\u2019s also been pointed out that those customers who respond with fresh consent are proving themselves more valuable because of their willingness to engage with your business.<\/p>\n\n\n\n

    Remember that consent is only one possible requirement for lawful processing. If an ongoing contract between you and a customer or client already exists \u2013 or is likely to do so soon \u2013 then you don\u2019t necessarily have to get consent, for example, where that processing is necessary for the performance of a contract or in the legitimate interests of your business and\/or the customer.<\/p>\n\n\n\n