PIPELINEGlossary · Legal and compliance
What does GDPR require from businesses?
The General Data Protection Regulation governs how personal data may be processed. Core obligations are: specify a legal basis, define the purpose, collect only as much data as necessary, set deletion deadlines, and inform those affected in clear terms.
01 — Context
GDPR in Detail
Personal data includes more than many assume: name, email address, phone number, IP address, photos, and in some cases license plates or customer numbers. As soon as a person can be identified, the regulation applies.
When external service providers are involved — hosting, newsletter, chat, analytics — you need a data processing agreement with each one and must verify where processing takes place. Additional safeguards are required for transfers outside the EU.
02 — Practice
What this means for small businesses
In small businesses, the same three things are almost always missing: a defined deletion deadline, notice at the point where data is actually collected, and clarification of whether the provider uses the data for their own purposes.
03 — Questions
Frequently asked questions
Do we need a data protection officer?
Only under certain conditions, such as extensive processing of sensitive data. For most small businesses, this doesn't apply — but designating a responsible person internally still makes sense.
Is a privacy policy enough?
No. It's the public-facing information, but it doesn't replace the legal basis, deletion concept, or contracts with service providers.
04 — Continue
Related terms and services
- Data processing agreement
- EU AI Act
- Hallucination
- Language model (LLM)
- AI Overview
- AI phone assistant
- All terms
Related services
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.