5 GDPR Myths Small Businesses Still Believe
Checked against the GDPR text and the EDPB's data protection guide for small businesses on 24 October 2026. General information, not legal advice.
Myth 1: "We're too small for the GDPR to apply"
The GDPR doesn't exempt businesses by size. What it excludes is processing "by a natural person in the course of a purely personal or household activity" (Article 2). A freelancer with a client list is running a business, not a household.
Instead: assume it applies if you handle data about identifiable people, such as customers, subscribers or staff.
Myth 2: "We always need consent"
Article 6 lists six lawful bases. Consent is one. The others include performing a contract, complying with a legal obligation and legitimate interests.
If a customer orders from you, you usually don't need consent to use their address to deliver the order. That's necessary for the contract. Consent matters more for things like marketing to people who aren't customers.
Instead: for each use of personal data, name its legal basis and write it down.
Myth 3: "Any mistake means a €20 million fine"
Article 83 sets the top tier at up to €20 million or 4% of worldwide annual turnover, whichever is higher. A lower tier goes up to €10 million or 2%. These are ceilings.
The same article says fines must be "effective, proportionate and dissuasive," and that authorities weigh factors such as the nature, gravity and duration of the infringement. Authorities can also use other corrective measures instead of, or as well as, fines.
Instead: take it seriously, but focus on the basics rather than the headline number.
Myth 4: "Under 250 employees, we don't need records"
Article 30(5) does exempt organisations with fewer than 250 people from keeping records of processing, but not if the processing:
- is likely to result in a risk to people's rights and freedoms,
- is not occasional, or
- includes special categories of data, such as health, or criminal records.
Regular processing, such as a customer database or payroll, is not occasional. So many small businesses still need records.
Instead: keep a simple record of what data you hold, why and for how long. It also helps when you get an access request.
Myth 5: "The GDPR is being scrapped anyway"
In November 2025 the European Commission proposed a "Digital Omnibus" with amendments to the GDPR. On 21 October 2026 the Council of the EU agreed its negotiating position. That isn't the final law. It still has to be negotiated with the European Parliament, which hasn't adopted its own position yet.
Instead: comply with the GDPR as it stands today, and watch for changes.
The small-business minimum
The EDPB's guide for SMEs is a good free starting point. Start with these four steps:
- Know what personal data you hold and why.
- Have a clear privacy notice.
- Be ready to answer requests from people about their data within one month.
- Secure the data, and know what to do if there's a breach.
Go deeper
GDPR Myths That Could Cost You €20M debunks the ten most common misconceptions, explains where the €20M figure really comes from, and sets out the real compliance minimum for a small business.
👉 Find it at bookpilot.org/books
Sources
All consulted on 24 October 2026.