Data protection in an SME: how to organize daily work, step by step

01

The short answer

An SME organizes data protection by combining organizational measures (internal policy, training, information classification) and technical measures (secure workstations, automatic locking, firewall, antivirus) around a periodic risk assessment.

GDPR requires the same level of security regardless of the equipment used, and the employer remains responsible even for data processed on devices it does not directly control.

02

Why it matters every day, not only at project stage

Data breaches can cause financial loss, fines and a drop in customer trust; this is why good cyber-security practices serve to prevent incidents before they happen, not only to manage them afterwards.

An organization that applies data protection by design considers risks and mitigation measures before starting any processing, rather than as a later fix.

03

The operational sequence

Steps

1. Create and keep updated a risk spreadsheet, including material and human risks related to servers, computers and premises.
2. Raise awareness among data handlers with periodic sessions and document procedures in clear language for each role.
3. Define a binding internal policy describing the data protection and security rules.
4. Classify information by level and mark documents and emails containing confidential data.
5. Secure workstations with automatic locking, firewall, up-to-date antivirus and storage with regular backup.

04

Example from the EDPB guide: the online bookshop

A bookshop wants to sell books online and creates an order form with all fields mandatory, including date of birth, phone number and home address. But not all the data is needed for the purpose: for a directly downloadable eBook, the home address is not necessary.

This is the concrete example of minimization: collecting only the data relevant and limited to what the service actually offered requires.

05

Checks to verify periodically

• Provide each user with a unique identifier and require authentication to access IT facilities.
• Manage separate authorizations by profile, with strong passwords and periodic access review.
• Remove outdated access authorizations without delay.
• Assess pseudonymization or encryption of data and a dedicated VPN for remote work.
• Also protect personal devices (BYOD) used to connect to the company network.

06

What a business can set up in its own management software

Regardless of the tool chosen, a business can ask its software provider to track who has access to which data, with separate profiles by role and a log of changes to authorizations, so as to support the periodic review required by good security practices.

It is also useful to be able to centrally document internal procedures (classification policy, training completed, review deadlines), making them accessible to those handling data without having to reconstruct them from memory.

07

Frequently asked questions

Who should be involved in awareness-raising? All data handlers, meaning anyone who processes personal data in daily operations, not only the IT manager.

Must protection be redone for every project? Protection by design should be considered before any new processing, assessing its nature, context and specific risks.

Are personal devices excluded from security obligations? No: the employer remains responsible for data security even on BYOD devices authorized to access company resources.

08

The next practical step

Start with the risk spreadsheet: list servers, workstations and premises, assign a responsible person for each item and set a review date in three months. From there follow training, internal policy and technical measures.