01
Data protection is daily work, not a one-off project
An SME organizes personal data protection by combining organizational and technical measures, applied consistently in day-to-day activities. The EDPB guide for small businesses indicates that hardware, software, communication channels, paper documents and premises must be protected, and that trust in the reliability of information systems is a key issue made mandatory by the GDPR.
02
Why a role-based approach is needed
The employer remains responsible for the security of personal data even when it is processed on personal devices (BYOD) over which they have no physical control, if they have authorized access to company IT resources. The level of security required by the GDPR must be the same regardless of the equipment used, which makes it necessary to define clear roles and responsibilities for those who process data.
03
A five-step workflow
Steps
- Define a binding internal policy with data protection and security rules.
- Regularly raise awareness among data handlers about risks and adopted measures.
- Apply data protection by design, limiting the data processed to what is necessary.
- Manage unique identifiers, authentication and authorizations, with periodic review of access.
- Document operating procedures and keep them updated and accessible to data handlers.
04
A hypothetical case: the online order form
Hypothetical example based on the EDPB guide: a bookshop selling books online makes all fields of an order form mandatory, including date of birth, phone number and address. By applying data protection by default, the owner should limit the fields to what is necessary for the purpose, for example not requesting an address for a directly downloadable eBook.
05
Controls to check regularly
- Outdated access authorizations have been removed and periodically reviewed.
- Automatic session locking, firewalls and antivirus are up to date on every workstation.
- Documents containing sensitive data carry a visible, explicit indication.
- A confidentiality agreement or clause has been signed with employees and collaborators.
- A risk management sheet has been prepared and is updated regularly.
06
What a company can configure with its software partner's support
A company can ask its software provider to support distinct roles for data handlers, traceability of granted and revoked authorizations, and periodic reminders for security training. These are suggested operational choices, not guaranteed features: they should be defined together with the provider based on the nature, context and scope of the intended processing.
07
Frequently asked questions
The following answers clarify only what is already stated in the article, without introducing new information.
08
Practical next step
Steps
- Draft or revise the binding internal policy on data protection and security.
- Schedule an awareness session with data handlers within the next quarter.
- Check with your software provider which roles and authorizations can be configured.
FAQ
Frequently asked questions
Who is responsible if an employee uses a personal device for work?
The employer remains responsible for the security of personal data even on personal devices (BYOD), if they have authorized access to company IT resources.
What does data protection by design mean?
It means incorporating data protection into every stage of processing and ensuring that, by default, only the data necessary for the specific purpose is processed.
Which organizational measures are indicated as essential?
A binding internal policy, periodic awareness sessions, classification of confidential information, and confidentiality agreements with data handlers.
✓