Data protection in a small business

In short: Even a small business must comply with the GDPR: collect customer data sparingly, store it securely and keep it only as long as necessary.

In more detail: As soon as names, addresses, emails or orders are processed, information duties, access rights and deletion duties apply. For websites a privacy policy and cookie consent are added.

In detail

• Legal basis: contract, consent or legitimate interest.
• Records: even small businesses should document which data they process and why.
• Processors: conclude contracts with service providers (hosting, shipping, mail).
• Deletion: keep invoice data 8 to 10 years (tax law), delete other data earlier.
• Security: passwords, backups, encryption.
• Fines: violations can lead to complaints and fines.

See also: Online shop as a small business: duties, Retention periods for receipts