SMBs — the essentials

Law 25 obligations apply regardless of size. For an SMB, the challenge is prioritization.

The 6 priorities

1. Designate the RPRP: the CEO by default, or an employee part-time designated in writing; publish their title and contact details.
2. Publish a privacy policy that is clear, short and current.
3. Map your personal information (customers, employees, suppliers): where, why, for how long.
4. Check your common SaaS tools (Google Workspace, Microsoft 365, Shopify, accounting, payroll): contract/DPA, location, security.
5. Prepare incident response: who to alert, the minimal register, the templates.
6. Train the team: this 30-minute path for everyone.

Example. An 8-person shop uses a marketing email tool: it checks where the data is, obtains explicit consent from subscribers and offers a simple unsubscribe.

See the SMB checklist.