A company with 3 employees processes as many categories of personal data as a large group, just on a smaller scale. Customer files, job applications, payroll, prospects: GDPR for very small businesses applies from the first spreadsheet row, with no headcount threshold.
The difficulty in complying with these rules therefore lies less in the principle than in the method.
The teams behind our customizable, flexible CRM support business owners who structure their GDPR compliance without needing a legal department.
In this article you will find the 4 obligations that apply to your organization, the method for keeping your record of processing activities, and the consequences of your hosting location on your responsibility as a business owner.
- Scope: GDPR covers any organization that processes personal data, regardless of size or revenue.
- Record of processing activities: it is the central document of your compliance file.
- Minimization: collection is limited to the data needed for the stated purpose, with a defined retention period for each.
- Data breach: notification to the CNIL must be made within 72 hours of discovering the incident.
- Hosting: the storage location engages your company’s responsibility, as data controller.
Is a very small business really concerned by GDPR?
Yes, a very small business falls fully within the scope of GDPR as soon as it processes personal data. The CNIL states this unambiguously: the regulation sets no headcount threshold. A craftsman who keeps their customers’ contact details is therefore processing personal data, just like a company of 500 people.
Moreover, the criterion is the activity, not the legal status. The same principles therefore govern non-profit organizations, with a few specific features detailed in our article on an association’s GDPR obligations.
On the other hand, the size of the organization changes the intensity of the measures expected, not their nature: GDPR compliance for an SME involves more departments and providers. The CNIL assesses these measures in light of the risk each processing activity poses to the people concerned.
The 4 obligations that apply in practice
For a small organization, GDPR boils down to 4 operational obligations. Addressing them in order gives clear compliance, without documentation designed for a legal department. The CNIL and Bpifrance guide follows the same progression. Here are these 4 obligations:
- The record: list your processing activities in a single document, stating what you collect, why, and for how long.
- Minimization: limit collection to the data needed for the stated purpose, removing fields inherited from old forms.
- Information: inform the people concerned at the time of collection, then respond to their requests for access, rectification or erasure.
- Security: protect access to files and notify the CNIL of any breach within 72 hours, a deadline that runs from the discovery of the incident.
Appointing a data protection officer is mandatory for only 3 categories of organizations, none of which covers the typical very small business. Nothing prevents you, however, from entrusting the subject to an identified person in-house. Our observations in the field: organizations that appoint a lead, even very part-time, keep their record up to date over time.
The record of processing activities, the cornerstone of the file
The record of processing activities lists all the ways you use personal data. It shows the seriousness of your approach in a few minutes, which makes it the first document to produce.
For a very small business, it covers in practice everyday processing activities: customer management, sales prospecting, supplier relations, recruitment, payroll, and video surveillance where it exists. Each entry states the purpose pursued, the categories of data, the recipients, the retention period and the security measures adopted.
The challenge then shifts to keeping it up to date. A new tool or a new form, and the record falls behind: schedule its review at the same time as your year-end closing, once a year.
Where your data is hosted: a compliance criterion
The storage location of your data engages your company’s responsibility, whatever provider you choose. A transfer outside the European Union requires additional safeguards that few small organizations know how to document. Choosing European hosting therefore removes this complexity.
We built Cirrus Shield on this principle: we host our customers’ servers and data in France, with OVH in Roubaix. Encryption covers data both in transit and at rest, and daily backups rely on multi-zone redundancy.
Our CRM designed for very small businesses centralizes contacts, quotes and exchanges in one place, which automatically reduces the number of files to list in the record. Its low-code configuration lets you adapt the fields collected to your business, with no development or project budget, which directly serves the data minimization required by GDPR.
When a business owner asks us where their data is hosted, they expect a clear answer rather than a legal lecture. We tell them France, and that detail reassures them immediately.
FAQ – GDPR and very small businesses
What does a very small business risk for failing to comply with GDPR?
In the event of a breach, a very small business is exposed to CNIL sanctions, which target organizations of all sizes. Depending on the severity, it issues a reminder, a formal notice, an injunction with a penalty payment or a fine. A complaint filed by an employee or a customer is enough to trigger an audit.
Is the record of processing activities mandatory below 250 employees?
Yes, in almost all cases. The exemption for organizations with fewer than 250 employees only covers occasional, risk-free processing. Customer management, payroll and recruitment are regular processing activities, and must therefore be recorded.
Does a very small business need a data protection officer?
Appointment is mandatory for 3 categories of organizations: public authorities, those monitoring people on a large scale, and those processing sensitive data on a large scale. A typical very small business therefore appoints an internal lead by choice, to sustain the approach over time.
How long should customer data be kept?
The period is defined according to the purpose pursued. The CNIL sets 3 years after the last contact for sales prospecting data, while the French Commercial Code requires 10 years for accounting records. Record each period in the register, then schedule an annual purge.
What should you do in the event of a data leak?
Document the incident, assess the risk to individuals, then notify the CNIL within 72 hours when that risk exists. If the breach seriously exposes the people concerned, inform them too, in clear terms and without technical jargon.
- Appliquer le RGPD dans une TPE ou PME (Applying GDPR in a small business or SME), CNIL Q&A
- Le registre des activités de traitement (The record of processing activities), CNIL
- Les grandes étapes pour protéger les données (Key steps to protect data), CNIL and Bpifrance guide
