GDPR applies to businesses of every size that process personal data. For Irish SMEs, a few practical steps cover the essentials. This is general guidance, not legal advice.
Know what you collect
List the personal data you hold, why you hold it and where it is stored.
Publish a clear privacy notice
Explain how you use data, your legal bases and how people can exercise their rights.
Cookie consent
Non-essential cookies, including most analytics and advertising cookies, need consent before they are set.
Work with trustworthy processors
Ensure suppliers that process data for you have appropriate agreements and safeguards.
Respond to requests
Have a simple process to handle access and deletion requests promptly.
FAQs
Do we need a data protection officer?
Only in certain circumstances; most small businesses do not.
Can we use US-based tools?
Yes, with appropriate transfer safeguards in place.
What about marketing emails?
Electronic marketing rules require consent or a valid soft opt-in.
