GDPR and IT: the basics every SME must meet

GDPR scares people more by its acronym than by what it asks for. Most companies meet the essentials with reasonable, common-sense measures, many of them technical. We explain, without legal jargon, which part of GDPR touches your IT and what you should have in order.

A starting caveat: this is a practical guide, not legal advice. For the legal side, rely on your lawyer or data-protection advisor. Here we talk about the technical side, which is our area.

What GDPR asks of your IT

The General Data Protection Regulation requires, among other things, that you protect the personal data you handle (of customers, employees and suppliers) with appropriate security measures. It does not give a closed list, it asks that they be reasonable for the risk. In practice, that translates into very concrete things.

The basics you should have in order

• Access control. Each person accesses only what they need, with individual accounts and strong passwords.
• Multi-factor authentication on email and systems with personal data. It is one of the most effective measures and we explain it in what two-factor authentication is.
• Backups that let you recover data after a failure or an attack, genuinely tested.
• Protection against threats: up-to-date antivirus, email filtering and patched devices.
• Encryption of laptops and devices that leave the office, so a theft is not a data breach.
• Leaver management: revoking access when someone leaves the company.

What happens if there is a breach

If you suffer an incident affecting personal data (ransomware, a compromised email, a stolen unencrypted laptop), GDPR requires you to act fast and, in many cases, to notify the authority within a short deadline. Having the technical measures in order reduces the chance it happens and shows due diligence if it does.

GDPR as an excuse to do the right thing

The interesting part is that almost everything GDPR asks for on the technical side is, simply, good security. The same measures that protect you from a cyberattack put you in compliance. So do not see it as a separate burden: it is the same list you should already have in your own interest. We cover it within cybersecurity for businesses, starting with an assessment of where you stand today.

Frequently asked questions

What does GDPR require at the IT level?

That you protect personal data with reasonable security measures: access control, two-factor, backups, protection against threats, device encryption and leaver management. It does not give a closed list, it asks that they be appropriate to the risk.

What happens if I have a data breach?

GDPR requires you to act quickly and, in many cases, to notify the breach to the authority within a short deadline. Having the technical measures in order reduces the risk and shows due diligence.

Is complying with GDPR very expensive for an SME?

The technical side largely overlaps with the good security you should already have. It is usually not a separate cost, but the same investment that protects you from an attack.