General Data Protection Regulation (AVG)

The General Data Protection Regulation (GDPR) is the European privacy law that sets out how companies and organisations must handle personal data. The regulation gives EU residents control over their own data and obliges companies to be transparent about data collection, to seek consent where necessary, and to implement appropriate security measures. For any SME that processes customer data, compliance is not a choice but a legal obligation.

How does the GDPR work in practice for your company?

The GDPR is based on six principles which, together, determine how you handle personal data. You may only collect data for a clearly defined purpose, such as processing an order or sending a newsletter. You must not collect more data than is strictly necessary for that purpose. You must not retain data for longer than necessary and must ensure adequate security against data breaches. In addition, you must be able to inform people about what data you hold, amend or delete it on request, and, in certain cases, seek explicit consent. The Dutch Data Protection Authority enforces these rules in the United Kingdom and may impose fines of up to 20 million pounds or 4 per cent of global annual turnover in the event of breaches. In practice, we see fines for small and medium-sized companies mainly in the range of a few thousand to tens of thousands of pounds in cases of serious negligence or data breaches.

Why the AVG came and why it still matters today

Prior to 2018, each EU country had its own privacy rules, which made cross-border trade complex and provided citizens with unequal protection. The GDPR harmonised this legislation and brought the rules into line with the digital reality in which companies collect data on a massive scale via websites, apps and cloud platforms. The regulation recognises that personal data has economic value and that citizens have the right to access and control it. Although the GDPR has been in force for years, compliance remains a topical issue. New technologies such as AI-powered chatbots, marketing automation and analytics require ongoing assessment of whether you meet the GDPR’s requirements. We are also seeing that regulators are enforcing the rules more strictly as companies collect more data.

What GDPR compliance means for your SME company

Many business owners view the GDPR primarily as an administrative burden, but proper compliance also offers business benefits. Customers trust companies that are transparent about data usage and have a clear privacy policy. In tenders and partnerships, larger clients often enquire about your GDPR compliance before signing a contract. Furthermore, you avoid reputational damage and fines resulting from data breaches or complaints to the supervisory authority. Combined with a professionally designed website that correctly integrates cookie banners, privacy statements and opt-in forms, you demonstrate that you take customer data seriously. This sets you apart from competitors who treat privacy as an afterthought and increases the likelihood that visitors will share their data with you.

The General Data Protection Regulation affects almost every aspect of your business operations where you handle customer or employee data. From your newsletter to your recruitment process, from your online shop checkout to your CRM system: wherever you collect names, email addresses, telephone numbers or other identifiable information, you are obliged to comply with the GDPR rules. The specific impact varies depending on the type of company and the volume of data you process.

Website visitors and cookie consent

As soon as you have a website with analytics, contact forms or chat functions, you are processing personal data. You must clearly inform visitors which cookies you set and what you use them for. A cookie banner that only displays an ‘Accept’ button does not comply with the GDPR: visitors must be able to opt out just as easily as they can opt in. You must also publish a privacy policy explaining what data you collect, how long you retain it and with whom you share it. A professionally designed website includes this functionality as standard, including a cookie notice that meets the requirements of the Dutch Data Protection Authority.

Client data in CRM and email marketing

If you store customer data in a CRM system or email marketing tool, you must be able to demonstrate that each contact has given their consent. A ticked box during checkout or a registration form with double opt-in is sufficient, provided you record the date and context of the consent. Customers have the right to access, amend or have their data deleted. In practice, this means you must have a process in place to comply with such a request within one month. For small and medium-sized companies with a mailing list of a few hundred contacts, this is still feasible to do manually, but with thousands of contacts, you will need automated exports and deletion scripts.

Personnel files and job applicants

HR processes also fall under the GDPR. Application letters and CVs contain personal data which you may only retain for as long as the vacancy is open, unless the candidate gives explicit consent for inclusion in a talent pool. Staff files containing payslips, appraisal interviews and any disciplinary measures must be secured and may only be accessible to those who genuinely need them. A common mistake: shared folders on the server that anyone can access, or old CVs that remain in an email inbox for years. The GDPR requires you not to retain personal data for longer than is necessary, which means you must actively delete it.

When General Data Protection Regulation is the right choice and when it is not

The question is not whether the GDPR applies to you, but how strictly you need to apply the rules. Do you only process the names and email addresses of a few dozen customers a year? Then a simple privacy statement and a structured way of handling requests will suffice. Do you collect sensitive data such as health information, financial details or location tracking? If so, you must carry out a Data Protection Impact Assessment and may need to appoint a Data Protection Officer. The Dutch Data Protection Authority takes a risk-based approach: the greater the impact on privacy, the stricter the requirements.