GDPR for Solopreneurs — The Plain-English Compliance Baseline

GDPR applies to a one-person business in Lisbon or Louisville alike if you handle EU residents’ personal data — and most founders overestimate the bureaucracy while underestimating the six concrete things actually required. The compliance baseline for a solo business is genuinely achievable in a day.

This guide walks it: does it apply to you, the lawful basis question, the six practical steps, the documents you need (they are few), and what regulators actually check when they check small businesses.

Who this playbook is for

Built for solo founders outside or inside the EU who touch any EU resident’s personal data.

Step 1: Confirm whether GDPR applies to you

Applies if: you offer goods/services to people in the EU, or monitor EU residents’ behavior (analytics, ads), regardless of where you sit. A US consultant with EU clients, a newsletter with EU readers, an e-shop shipping to Germany — all in scope. Not in scope: purely local business touching no EU data. When borderline, comply anyway — the steps below double as good practice everywhere.

Step 2: Establish your lawful basis per processing activity

Each thing you do with personal data needs a basis: consent (newsletter, marketing), contract (client contact and delivery), legitimate interest (basic analytics, fraud prevention — documented), legal obligation (invoices). Write one line per activity. The newsletter-consent case is the one that trips most founders: pre-ticked boxes and bundled consent are out.

Step 3: Create the minimum document set

Four items: privacy policy (plain-language: what you collect, why, how long, who processes it — mail tools, payment processors), cookie/consent banner if you track, a records-of-processing sheet (one page listing your activities), and data-processing agreements with your subprocessors (major tools provide these on request — Mailchimp, Stripe, etc. all publish DPAs). A weekend of paperwork, done once, reviewed annually.

Step 4: Build the data-subject response capability

People can ask: access their data, correct it, delete it, export it. Your capability: a stated channel (privacy@yourdomain), a 30-day clock, and actually knowing where their data lives (your records sheet tells you). For a solo business this is usually a search across email, CRM and payment tools — an hour per request, handled promptly and politely. Ignoring requests is what gets small operations reported.

Step 5: Handle the breach rule and the transfer basics

Breaches involving personal data risk get reported to your regulator within 72 hours when serious — your breach plan (see the data protection checklist) already covers detection and containment; add the notification step. Data transfers: using major US tools with EU adequacy or standard contractual clauses is today’s normal path — your tools’ DPAs document this. Do not build your own transfer legal theory; use the infrastructure the big processors already provide.

Your weekly operating rhythm

KPIs that tell you it is working

Common mistakes to avoid

• Assuming size exempts you. GDPR has no small-business exemption; it has proportionate enforcement. The solo compliance burden is real but small — the steps above are the whole burden.
• Buying consent (adding people from scraped lists or "partners"). Purchased lists under GDPR are violations with a paper trail attached — the list you bought is evidence of the breach.
• Building the documents and ignoring the practice. A privacy policy while ignoring deletion requests is worse than nothing — the policy documents the duty you then breached.

A tool stack that fits a one-person budget

Keep going

Use these internal references while implementing this guide:

• One Person Company Hub
• How to Start a One Person Company
• Solopreneur Operating System
• Liability Insurance for Solopreneurs
• The IP Assignment Clause
• The Independent Contractor Agreement

FAQ