Every time a customer leaves their email, an employee signs a contract, or a supplier sends an invoice, a company processes personal data. For 8 years now, all of this has been governed by an acronym many business owners have heard of but few truly understand: the GDPR. Understanding the GDPR is the first step toward handling privacy correctly and avoiding penalties that can reach up to 4% of global turnover. In this article we explain in simple terms the meaning of the GDPR, its European origin, the 7 principles that underpin it, and what has concretely changed for SMEs since May 25, 2018.
By the end you’ll have a clear picture of the obligations, opportunities, and upcoming changes in 2026, so you can understand where to start bringing your organization into compliance.
What is the GDPR: a simple definition
The GDPR is the European Union’s General Data Protection Regulation, in force since May 25, 2018. The acronym stands for General Data Protection Regulation and corresponds to EU Regulation 2016/679, approved by the European Parliament on April 27, 2016.
In practice, the GDPR is the European law that establishes how companies, professionals, and public administrations must collect, store, use, and protect the personal data of individuals. It applies to any information that can directly or indirectly identify a person: name, email, phone number, IP address, health data, photos, purchase preferences, and much more.
The key word to keep in mind is accountability: the GDPR requires companies to actively demonstrate that they comply with the rules, not just declare it. This is the real cultural shift brought about by the Regulation.
Personal data and special categories of data: the difference
The GDPR distinguishes between two broad categories of data. Common personal data includes ordinary information such as first and last name, address, tax code, company email, browsing data, and bank details. This data requires protection, but its collection follows standard rules.
Special categories of data, also commonly called sensitive data, include information that deserves reinforced protection: racial and ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and sexual orientation. Judicial data also falls into a special category. Processing this information requires stricter legal grounds and reinforced security measures, often accompanied by a specific impact assessment.
Who must comply with the GDPR
The GDPR applies to all organizations that process the personal data of people located in the European Union, regardless of where the company is based. A US-based e-commerce business selling to EU customers must comply with the GDPR exactly like a local shop in a small European town.
The scope of application includes:
Private companies of any size, from sole proprietorships to multinationals
Public administrations and public bodies
Freelance professionals such as lawyers, accountants, doctors, and consultants
Associations, foundations, and third-sector organizations
Startups and digital businesses based outside the EU but with European customers
The only exclusion concerns processing carried out by an individual for strictly personal or household activities, such as a private phone contact list.
The origin of the GDPR: why Europe wanted a new law
The GDPR arose from the need to update a regulation that was over 20 years old. The previous Directive 95/46/EC dated back to 1995, an era when the internet was in its infancy, smartphones didn’t exist, and social networks were science fiction.
With the explosion of digital technology, the flow of personal data changed radically. Big data, cloud computing, artificial intelligence, and global platforms made the old system, based on different national laws across the 27 member states, obsolete. The European Union therefore decided to replace the directive with a regulation, meaning a legal act that applies directly and uniformly across all EU countries, without the need for national implementing laws.
The approval process was long and complex, taking over 4 years of negotiations between the Commission, Parliament, and the European Council. The final text sought to balance two needs: protecting citizens’ fundamental rights and promoting the free flow of data within the digital single market.
Key milestones
Here are the key dates that marked the birth and evolution of the GDPR:
January 25, 2012: the European Commission presents the reform proposal
April 27, 2016: final approval of EU Regulation 2016/679
May 24, 2016: formal entry into force of the Regulation
May 25, 2018: full application in all member states, with a compliance deadline
September 19, 2018: Italy’s Legislative Decree 101/2018 enters into force, harmonizing the national Privacy Code with the GDPR
Since then, the European Data Protection Board (EDPB) has published dozens of guidelines clarifying the practical application of the Regulation in specific scenarios such as marketing, video surveillance, cookies, and international transfers.
The role of national data protection authorities
Each EU member state has its own supervisory authority. In Italy, for example, it is the Garante per la Protezione dei Dati Personali (Data Protection Authority), established back in 1997. With the GDPR, these authorities’ powers expanded: today they oversee the application of the Regulation, receive complaints from citizens, conduct inspections, and can impose very heavy administrative fines.
These authorities regularly publish rulings, FAQs, and operational templates that serve as a practical reference for companies. Their decisions often set precedents and guide entire economic sectors, from healthcare to digital marketing, from video surveillance to human resources.
The GDPR’s 7 fundamental principles
The GDPR is built on 7 general principles listed in Article 5, which serve as the compass for every data processing activity. Complying with these principles is the foundation of being compliant.
Lawfulness, fairness, and transparency
Every processing activity must have a valid legal basis among those provided for in Article 6: the data subject’s consent, performance of a contract, legal obligation, vital interest, public interest, or the controller’s legitimate interest. Processing must be fair toward the data subject and transparent: the person must know who is processing their data, for what purposes, and how. This is the source of the obligation to provide a privacy notice, a clear and complete document that every company must provide before collecting data.
Purpose limitation
Data collected for a specific purpose cannot be used for different, incompatible purposes. If you collect a customer’s email to send an order confirmation, you cannot automatically use it for promotional newsletters without further consent. This principle requires defining the purposes of processing explicitly in advance and adhering to them over time.
Data minimization
You must only collect the data strictly necessary to achieve the stated purpose. If an email address is enough to sign someone up for a newsletter, also asking for their date of birth, occupation, and home address violates the minimization principle. This approach also reduces risk in the event of a data breach: the less information you store, the lower the potential damage.
Accuracy
Data must be accurate and up to date. The data controller must adopt procedures to correct or delete inaccurate data without delay. The data subject has the right to request rectification at any time, and the company must respond within one month.
Storage limitation
Data must be kept only for as long as strictly necessary for the purposes of processing. Defining reasonable retention periods and documenting them in the record of processing activities is a specific obligation. At the end of the period, data must be deleted or irreversibly anonymized.
Integrity and confidentiality
Data must be protected with appropriate technical and organizational measures against unauthorized processing, accidental loss, destruction, or damage. Encryption, backups, access control, system updates, and staff training are the most common measures. The level of protection must be proportionate to the risk: health data requires greater safeguards than a simple list of company email addresses.
Accountability
This is the most innovative principle. The data controller must be able to demonstrate compliance with all the other principles. It’s not enough to be compliant: you must be able to prove it with documentation, records, procedures, impact assessments, and documented training. It’s the shift from a bureaucratic model to a management-based one, grounded in risk analysis and the ability to account for one’s own choices.
What has concretely changed for businesses
Before May 25, 2018, privacy in most EU countries was regulated by older national laws that required formal compliance steps, often little more than paperwork filed away and forgotten. With the GDPR, the approach changed profoundly: fewer standard forms, more substantive responsibility.
Businesses have had to rethink entire organizational processes. It’s no longer enough to fill out a form and file it away: what’s needed is a living privacy management system that accompanies every business activity, from collecting a candidate’s CV to managing the newsletter, from company video surveillance to server backups.
The most significant changes affect five operational areas: mandatory documentation, data subject rights, accountability roles, incident management, and penalties.
New mandatory documents
Companies must prepare and keep up to date a set of documents that includes:
Record of processing activities: a structured list of all personal data processing activities carried out by the company, including purposes, categories of data, recipients, and retention periods
Updated privacy notices for customers, employees, suppliers, candidates, and website visitors
Appointments of processors (external suppliers that process data on behalf of the company)
Data Protection Impact Assessment (DPIA) for high-risk processing
Internal policies on data breach management, exercising rights, and data retention
Training records provided to staff
New rights for data subjects
The GDPR strengthened and expanded individuals’ rights. Every citizen can exercise:
The right of access to their own data
The right to rectification in the event of inaccurate data
The right to erasure, known as the right to be forgotten
The right to restriction of processing
The right to data portability in a structured format
The right to object to processing
The right not to be subject to automated decision-making
Companies must respond to requests within one month, extendable to 3 months in complex cases, and must do so free of charge. Ignoring or mishandling such a request exposes the company to complaints to the Garante and to penalties.
The role of the DPO
The Regulation introduced the Data Protection Officer (DPO). Appointing one is mandatory for public administrations, for entities that carry out systematic large-scale monitoring, and for those that process special categories of data on a large scale. Many SMEs, while not required to, choose to appoint a DPO voluntarily to have a competent and structured point of reference on the matter.
GDPR penalties: what non-compliant companies risk
Penalties are one of the aspects that made the GDPR famous worldwide. They are calculated based on the company’s global annual turnover and can reach very high amounts.
The Regulation provides for two levels of administrative fines. Less serious violations, such as failure to keep a record of processing activities or failure to appoint a DPO, can result in fines of up to €10 million or 2% of global annual turnover. More serious violations, such as failure to comply with fundamental principles or data subjects’ rights, can reach up to €20 million or 4% of global annual turnover. The higher of the two amounts always applies.
Beyond financial penalties, there are indirect consequences that are often more damaging: loss of reputation, mandatory public notification of the data breach, individual and collective compensation claims, and the Garante’s power to block certain processing activities.
Real-world enforcement examples
Italy’s Garante, like other national authorities across the EU, has issued numerous significant fines in recent years. Telecommunications companies, utilities, digital platforms, hospitals, and municipalities have been sanctioned for violations often involving aggressive telemarketing, failure to obtain consent, inadequate privacy notices, unreported data breaches, and unlawful video surveillance. These decisions are public and represent a valuable resource for understanding which behaviors to avoid and how to structure your own processes.
How to reduce the risk of penalties
The most effective strategy is to demonstrate that you have adopted a serious, documented approach to compliance. In the event of an inspection or data breach, the Garante evaluates the company’s overall attitude: having up-to-date documentation, staff training, operational procedures, and adequate technical measures can significantly reduce the amount of the fine or lead to a simple warning.
Data breach: what it is and how to handle it
A data breach is a security incident that leads to the destruction, loss, alteration, unauthorized disclosure of, or access to personal data. It can result from a cyberattack, but also from human error, such as sending an email to the wrong recipient or losing a company laptop.
The GDPR requires the data controller to notify the Garante of every breach within 72 hours of discovery, unless it is unlikely to result in a risk to data subjects’ rights. If the breach presents a high risk, the affected individuals must also be informed directly, in clear language with practical instructions on how to protect themselves.
Properly handling a data breach requires a predefined internal procedure involving IT, legal, communications, and management. Improvising within 72 hours is impossible: preparing in advance is key.
Documenting incidents
Even incidents that are not reported to the Garante must be recorded in an internal breach register, describing the event, its causes, the data involved, the measures taken, and a risk assessment. This register is one of the most frequently requested documents during an inspection and demonstrates the company’s ability to monitor and manage incidents in a structured way.
GDPR and websites: cookies, forms, and newsletters
Every company website is a point where personal data is collected and is therefore subject to the GDPR. The three most critical areas are: cookies, contact forms, and newsletter sign-ups.
Cookies require a compliant cookie banner that lets users accept, reject, or customize their choice before any non-technical cookies are activated. The Garante’s June 2021 guidelines clarified that scrolling or simple browsing does not amount to consent, and that rejecting must be as easy as accepting.
Contact forms must include a specific privacy notice, a consent checkbox where necessary, and the collection of only essential data. Newsletters require explicit consent, separate from other purposes, preferably with a double opt-in and the ability to unsubscribe at any time.
Video surveillance and the GDPR
Company cameras also fall under the GDPR. Businesses must display a brief notice before the monitored area, assess the proportionality of the processing, limit image retention to a few days (generally 24-72 hours, unless there are specific reasons for longer), and adequately protect the recording systems. The Garante has published detailed guidelines and repeatedly sanctioned systems installed without these safeguards.
GDPR and ISO 27001: why integrate the two systems
The international ISO 27001 standard defines the requirements for an information security management system. Many of the measures required by the GDPR find a concrete operational tool in ISO 27001: risk analysis, access control, incident management, encryption, training, and supplier management.
Integrating GDPR and ISO 27001 lets you kill two birds with one stone: you build a single system that meets both European regulatory obligations and the requirements of the international standard, which is valued by customers and partners especially in the technology, healthcare, and financial sectors.
ISO 27001 certification is not mandatory for GDPR compliance, but it represents the strongest evidence of having adopted adequate security measures. In the event of a data breach or inspection, certification is a strong mitigating factor demonstrating the company’s responsible approach.
Synergy with other standards
Beyond ISO 27001, the GDPR integrates well with ISO 9001 on quality, ISO 42001 on artificial intelligence management systems, and the NIS2 Directive on cybersecurity. Building an integrated management system saves time, reduces duplicated documentation, and lets you present a complete compliance posture to the market.
What’s coming in 2026
The European regulatory framework on data protection continues to evolve. 2026 will bring several changes that businesses need to start monitoring right away.
The proposal to simplify the GDPR for SMEs, presented by the European Commission in 2025 as part of the Omnibus package on digital simplification, is well advanced. The goal is to reduce the documentation burden for companies with fewer than 750 employees, while keeping the principles protecting data subjects fully intact. The simplifications will affect the record of processing activities, some impact assessments, and notification obligations in low-risk cases.
At the same time, the EU AI Act will come into full effect, intertwining with the GDPR whenever AI systems process personal data. Companies using AI for recruitment, predictive marketing, credit scoring, or customer service will need to manage the two regulatory frameworks in a coordinated way.
Implementation of the Data Act and the Data Governance Act will also continue, reshaping how non-personal and industrial data can be shared within the European single market. While they don’t directly amend the GDPR, they require updates to internal data management procedures.
How to prepare
To face 2026 with confidence, it’s worth carrying out a full check-up of your privacy system during 2025. Reviewing privacy notices, the record of processing activities, data breach procedures, staff training, and technical security lets you start from a solid base on which to build the new rules. Companies that delay risk being caught unprepared just as the framework becomes more complex.
Get your company compliant with Complaion
Understanding the GDPR is the first step. Actually applying it in your company requires the right method, expertise, and tools. Complaion supports SMEs through the entire GDPR compliance journey: initial analysis, documentation drafting, staff training, operational procedures, data breach management, and ongoing monitoring. Thanks to our digital platform and dedicated consultants, we drastically reduce compliance timelines compared to traditional approaches, getting you compliant in a few weeks instead of many months.
Every project is built around your company’s real situation: sector, size, processes, and starting point. Request a free consultation and a tailored quote from Complaion and discover how to secure your organization’s data with an expert partner by your side.
Frequently asked questions about the GDPR
Does the GDPR apply to small businesses and freelancers too?
Yes, the GDPR applies to anyone who processes personal data in the course of their activity, regardless of size. Even a sole proprietorship with a single employee, a craftsperson with private customers, or a freelance professional must comply with the Regulation. Operational procedures and documentation complexity vary, but the fundamental principles apply to everyone. Some obligations, such as appointing a DPO, depend on the nature of the processing rather than the company’s size.
What is the difference between a data controller and a data processor?
The data controller is the one who decides the purposes and means of data processing, i.e. the company or professional that collects and uses the data for its own purposes. The data processor, on the other hand, is an external party that processes data on behalf of the controller, such as a cloud service provider, a payroll consultant, or an email marketing agency. A specific contract governing the processing, as required by Article 28 of the GDPR, must always be signed between the controller and the processor.
Is consent always required to process personal data?
No, consent is just one of the 6 legal bases provided for by the GDPR. Many processing activities are based on other grounds, such as performance of a contract (e.g. data needed to issue an invoice), legal obligation (e.g. tax record retention), legitimate interest (in specific documented cases), or public interest. Consent is required in specific cases such as promotional newsletters, non-technical cookies, or processing special categories of data with no other legal basis.
What should I do if I suffer a cyberattack with data loss?
Immediately activate the internal data breach procedure, assess the extent of the breach and the risk to data subjects, notify the Garante within 72 hours of discovery through the dedicated portal, and, if the risk is high, inform the affected individuals directly. The incident must always be recorded in the internal breach register, even when notifying the Garante is not required. Having a predefined procedure and a trained team is essential to meet the very tight deadlines set by the law.
Can I keep customer data forever?
No, the storage limitation principle requires that data be kept only for as long as strictly necessary for the purposes of processing. Retention periods vary depending on the type of data and purpose: tax and accounting data must be kept for 10 years by law, contracts generally for the statute of limitations period for contractual claims, and marketing data usually for much shorter periods. Every company must define its own retention periods in the record of processing activities and apply them consistently.
Does the GDPR require having a DPO?
Appointing a DPO is mandatory only in three cases: public administrations and public bodies, core activities consisting of systematic large-scale monitoring of data subjects, and core activities consisting of large-scale processing of special categories of data. Most SMEs are not required to, but may choose to appoint a DPO voluntarily anyway. Even without a DPO, someone inside or outside the company must competently oversee the matter.
What is the minimum fine under the GDPR?
The GDPR does not set strict minimum fines, but it establishes proportionality criteria. The Garante assesses the severity, duration, and nature of the violation, the number of data subjects affected, the damage suffered, the degree of responsibility, the measures taken to mitigate the damage, previous violations, and cooperation with the authority. Fines can also be replaced with warnings in minor cases, especially if the company demonstrates a serious and cooperative approach. The maximum amount can reach €20 million or 4% of global annual turnover.
What will change with the GDPR simplification for SMEs planned for 2026?
The simplification proposal aims to reduce the documentation burden for companies with fewer than 750 employees, easing some obligations such as keeping a record of processing activities for low-risk activities and simplifying certain impact assessments. The fundamental principles of the GDPR will remain unchanged, as will data subjects’ rights and the obligation to ensure data security. SMEs will still need to maintain a solid privacy management system, but will be able to benefit from streamlined procedures in specific situations.
