Data protection safeguards the personal data of natural persons from unlawful processing, misuse, and loss of control. For SMEs, data protection therefore means: You consciously decide which data you collect, for what purpose you use this data, which legal basis applies, how long you store data, and who has access to it.
In my work with small and medium-sized enterprises, I often see the same pattern: data protection is only considered when relaunching a website, setting up tracking, creating a newsletter (a "newsletter" is essentially nothing more than a digital message regularly sent to subscribers. Imagine you have a favorite magazine... Click and learn more) , or when introducing new AI tools. This is too late because data flows are usually already established by then.
Good data protection processes reduce risk, create clear responsibilities within the team, and strengthen trust in your brand. Definition of Brand: Brand (also Brands) comes from English and stands for trademark. A brand is a distinctive identifier that identifies products or services... Click and learn more . For me, data protection is therefore part of the digital business strategy, not just legal documentation.
Data protection is the organizational and legal framework within which digitalization works . Digitalization explained simply: Digitalization is the conversion of analog or manual processes into digital, traceable, and measurable processes. For SMEs, digitalization doesn't primarily mean new... Click to learn more about how it works reliably.
Data protection for SMEs: a brief definition
The GDPR stands for General Data Protection Regulation and refers to the same EU regulation, which is called the General Data Protection Regulation or GDPR for short. There is a difference between GDPR and the GDPR itself... Click to learn more . Article 4, No. 1 defines personal data as any information relating to an identified or identifiable natural person. This can include name, identification number, location data, or online identifiers. For an SME, this means that not only obvious information such as name, address, email address, or telephone number is relevant. IP addresses, customer numbers, application documents, employee data, CRM notes, order histories, and tracking data can also be considered personal data.
Special categories of personal data require increased care. These include, for example, health data, biometric data, or information about political opinions, religion, or trade union membership. Such data can arise in applications, employee administration, photos, health questionnaires, or sensitive customer projects.
What data protection checks in everyday business
Data protection begins with a concrete question: What personal data do you process and for what purpose? Processing doesn't just mean storage. Collecting, sorting, evaluating, forwarding, deleting, or accessing data can also constitute processing.
These areas are particularly relevant for SMEs:
- Website: Contact forms, server logs, embedded maps, videos, fonts, payment providers, chat tools and external services.
- Marketing: Newsletter, CRM Customer Relationship Management (CRM) is a company-wide strategy that allows you to systematically organize contacts, interactions, sales opportunities, and tasks throughout the customer relationship. A CRM for... Click to learn more, Lead forms, RemarketingRetargeting, also known as remarketing, is a form of online marketing in which users are targeted with advertising after they have visited a website or... Click to learn more, Conversion measurement, analysis tools and campaign evaluation.
- Tracking: CookiesCookies Simply explained: Cookies These are small text files that a browser stores for a website to manage sessions, preferences, or measurement data. Browser-Cookies or rather... Click to learn more, Pixel, Matomo, google analytics 4Google Analytics 4, or GA4 for short, is essentially the next generation of Google's popular web analytics platform. You may have heard of Universal... Click to learn more, Tag Manager and other tools that measure user behavior.
- Sales and customer service: Offers, invoices, meeting notes, email communication and support requests.
- Staff: Applications, employment contracts, payroll, time tracking, access rights and internal communication.
- AI tools: Text entries, uploaded documents, automatic summaries, chat histories and internal knowledge databases.
When strategically redesigning your website, data privacy shouldn't be added as an afterthought. In our web design and development work, we consider data flows, forms, tracking, and technical implementation from the very beginning. This doesn't replace legal advice, but it does create a sound technical and organizational foundation.
Legal basis: Consent is not always the answer
A common mistake is: "We'll just get consent everywhere." That sounds safe, but it's too simplistic. According to Article 6(1) of the GDPR, the processing of personal data is only lawful if at least one legal basis exists. Possible bases include consent, performance of a contract, legal obligation, or legitimate interest.
In practice this means:
- Consent: relevant for newsletter registration, certain Cookies, tracking or voluntary marketing measures.
- Fulfillment of contract: This is relevant if you need data to process an offer, a booking, a delivery or a service.
- Legitimate interest: Possible for certain internal processes, security measures, simple customer communication, or technically necessary protocols; always with documented consideration.
- Legal obligation: Relevant for accounting, tax retention obligations, or labor law documentation.
Especially in digital marketing, a clear distinction is worthwhile: What is technically necessary? What is analytics? What is advertising? If you want to delve deeper into consent, Matomo, and GA4, also read our article on GDPR-compliant tracking for SMEs.
Order processing and external service providers
Many SMEs work with external tools and service providers: hosting, newsletter systems, CRM, accounting software, cloud storage, maintenance providers, marketing platforms, or AI tools. When a service provider processes personal data on your behalf, this is often considered data processing on behalf of a controller.
Article 28(3) of the GDPR requires a contract or other legal instrument for processing by a data processor. This contract governs, among other things, the subject matter, duration, nature, and purpose of the processing. In practice, this is usually referred to as a data processing agreement or DPA.
Clarifying roles is crucial: The data controller decides on the purposes and means of processing. The data processor processes personal data on behalf of the controller. This distinction determines which obligations, contracts, and audits are necessary.
Privacy policy, cookie banner and deletion periods
A privacy policy clearly explains which personal data is processed, for what purposes, on what legal basis, by which recipients, and how long the data is stored. A good privacy policy makes data flows transparent.
A cookie banner is only useful if it accurately reflects the services actually used. If tracking, marketing,Cookies or if external analysis tools are used, you will often need effective consent and a clean [context/documentation]. Consent ManagementTechnically necessary Cookies are to be assessed differently than marketing or analysis-Cookies.
Data retention periods are also important. Data should not be stored indefinitely just because a system offers storage space. Check regularly:
- What customer data do you still need for ongoing projects?
- Which invoice data do you need to keep for tax reasons?
- Which application data can be deleted after the process is completed?
- Which newsletter contacts are inactive or without valid consent?
- Which old CRM notes no longer serve a legitimate purpose?
Data protection, information security and cybersecurity
Data protection, information security. Imagine you have a treasure chest full of valuable information. This chest contains everything your company knows about business partners, customer data, internal strategies, and more... Click to learn more . Cybersecurity. Cybersecurity protects digital systems, networks, devices, and data from attacks, misuse, outages, and data loss. For SMEs, cybersecurity is not a luxury and not purely an IT issue... Click to learn more. These terms are often confused but do not mean the same thing. Data protection regulates the lawful handling of personal data. Information security protects information in general, including trade secrets, offers, concepts, and internal documents. Cybersecurity protects digital systems from attacks, malware, phishing. Phishing is a fraudulent attempt in which attackers try to steal login credentials, money, or confidential information through fake messages, websites, QR codes, or phone calls. For SMEs, it is... Click to learn more , unauthorized access, and technical failures.
These areas are interconnected. Article 32(1) of the GDPR obliges controllers and processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Such TOMs can include access restrictions, encryption, backups, access control concepts, training, logging, or clear internal processes.
A pragmatic principle from my consulting practice: the smaller the company, the clearer the rules need to be. Small teams don't need corporate bureaucracy, but they do need clearly defined responsibilities, well-chosen tools, and transparent decision-making. This is precisely where strategic digitalization consulting can help, preventing poor decisions from creating unnecessary work.
AI tools and data protection
AI tools can make work easier, but personal data should not be fed into AI systems without careful consideration. Before using them, check: What data are you entering? Does the provider become a data processor? Is the input used for training purposes? Where is the data stored? What legal basis applies? Who on the team is authorized to use which AI tools and for what purpose?
For SMEs, simple internal rules are often sufficient as a starting point:
- Do not insert customer lists, applications, or health data into AI tools without verification.
- Anonymize or pseudonymize confidential documents before uploading them.
- Check the provider, storage location, contract terms and data processing.
- Document AI usage within the team and define responsibilities.
- Involve legal counsel in sensitive processes.
When AI ( Artificial Intelligence) is the umbrella term for digital systems that recognize patterns in data and take over tasks that would otherwise require human perception, assessment, or decision-making... Click to learn more and is considered a structured process within a company, data protection becomes predictable. Therefore, our work with AI and digitalization doesn't begin with the tool itself, but rather with its purpose, data flow, responsibility, and benefits.
FAQ: Data protection in everyday SME life
What are personal data?
Personal data is information relating to an identified or identifiable natural person. This includes not only name and email address, but also, depending on the context, IP address, customer number, location data, application documents, or CRM notes.
When do I need consent?
You need consent primarily when no other suitable legal basis applies or when users are asked to voluntarily agree to specific processing, such as for newsletters or many marketing and tracking services.CookiesHowever, consent is not the only legal basis; contract performance or legitimate interest may be more appropriate depending on the case.
What is order processing?
Data processing on behalf of a controller often occurs when an external service provider processes personal data on your behalf, for example, a hosting provider, newsletter tool, or cloud provider. In such cases, you generally need a data processing agreement that regulates obligations, purpose, duration, and security measures.
What should be included in a privacy policy?
A privacy policy should explain what data you process, for what purpose, on what legal basis, with which recipients, for how long, and what rights data subjects have. Chapter III of the GDPR contains, among other things, the rights to access, rectification, erasure, and restriction of processing.
How long am I allowed to store personal data?
Personal data may only be stored for as long as the purpose for which it was collected exists or as long as legal retention obligations apply. For SMEs, a simple deletion policy is therefore advisable, one that considers customer data, applications, newsletter contacts, invoices, and internal documents separately.
Is data protection the same as IT security?
No. Data protection regulates the lawful handling of personal data, information security protects information in general, and cybersecurity protects digital systems from attacks. In practice, these areas overlap because technical and organizational measures strengthen both data protection and security.
Conclusion
Data protection is not a mere legal detail for SMEs, but rather an integral part of a sound digital business strategy. Knowing what data you process, the applicable legal basis, the service providers involved, and when data is deleted reduces uncertainty and fosters greater trust.
This glossary entry provides guidance and does not replace individual legal advice. For specific legal questions, sensitive data, or complex processing activities, you should consult a specialized legal advisor. From a strategic perspective: those who consider data protection early on build better websites, more reliable processes, and a brand that people are more likely to trust.
Sources
- General Data Protection Regulation, Art. 4 No. 1 — dsgvo-gesetz.de (2016)
- General Data Protection Regulation, Art. 6 para. 1 — dsgvo-gesetz.de (2016)
- General Data Protection Regulation, Art. 28 para. 3 — dsgvo-gesetz.de (2016)
- General Data Protection Regulation, Art. 32 para. 1 — dsgvo-gesetz.de (2016)
- Federal Commissioner for Data Protection and Freedom of Information: Data subject rights under the GDPR — bfdi.bund.de
