GDPR applies to any business processing personal data of EU residents, regardless of where the business itself is based — size alone doesn’t exempt a business, though enforcement in practice does tend to focus on larger or more egregious cases.
Core requirements for a typical website
- A clear, accessible privacy policy explaining what data is collected and why
- A lawful basis for processing personal data (consent, contract necessity, legitimate interest, etc.)
- Cookie consent for non-essential tracking/analytics cookies, obtained before they’re set, not after
- A process for handling data subject requests (access, deletion, correction)
- Breach notification capability — generally within 72 hours of becoming aware, for breaches likely to risk individuals’ rights
Common small-business gaps
Analytics and marketing pixels firing before consent is obtained is one of the most common compliance gaps, since many analytics tools are configured to load by default rather than conditionally after consent.
FAQ
Does GDPR only apply to EU-based businesses?
No — it applies to any business processing the personal data of EU residents, regardless of where the business itself is located.