GDPR

The GDPR (General Data Protection Regulation) is European regulation 2016/679, applicable since 2018, governing the processing of personal data of anyone in the Union. It rests on six principles — lawfulness, minimization, accuracy, storage limitation, security, accountability — and relies on legal bases: consent, contract, legitimate interest, legal obligation. Penalties run up to 20 million euros or 4% of global turnover.

For a local business, the GDPR isn't the ogre it's painted as: its basic requirements fit in four gestures — know why you process (legal basis: contract suffices for managing customers), keep only what's needed and not forever, secure (encryption), and bind your vendors by contract. A call answered by a service, an exchanged text, a customer record: all of it is personal data. The GDPR doesn't say do nothing; it says know what you're doing.