Data Protection Compliance Basics for Growing Businesses

If you only do one thing this quarter, write down every place your business keeps personal data, who can reach it, and why you hold it. That single document, usually a spreadsheet, answers most of what a regulator, an enterprise customer or an insurer will ask you. Policies, consent banners and training all get easier once it exists, and almost every compliance project that stalls does so because nobody did this first.

Compliance starts with a data map

A data map is a list, not an architecture diagram. One row per system that holds personal data: the tool, what it stores, whose data it is, where it lives, who has access, how long you keep it, and the legal basis you rely on. Your accounting software, your CRM, the shared drive full of CVs from a hiring round two years ago, the marketing platform nobody has logged into since the last campaign. Forty rows is normal for a 30-person company.

Two things fall out of the exercise immediately. First, you find data you did not know you still had, which is the cheapest risk reduction available to you: delete it. Second, you find the systems where a single compromised login would expose the most people, and those become the places to spend money on access control and monitoring. Everything else in this article is easier once that list exists.

What enforcement actually looks like

Enforcement has moved from a trickle to a steady stream. The CMS GDPR Enforcement Tracker logged 3,295 publicly documented fines totalling roughly €7.56 billion when we checked it on 1 October 2026, with 249 of those cases recorded during 2026 alone. The Register, reporting DLA Piper’s January 2026 survey, put fines issued across Europe during 2025 at about €1.2 billion and the cumulative total since May 2018 at €7.1 billion, of which the Irish regulator alone accounts for €4.04 billion because so many large platforms are established there.

The number that matters more to a 40-person company is the breach workload behind those fines. The same DLA Piper survey counted an average of 443 personal data breach notifications a day across Europe between late January 2025 and late January 2026, up 22% year on year and the first time the daily average has passed 400. Regulators are not short of reading material, which is exactly why a clean, early, well-documented notification lands differently from a vague one sent three weeks late.

The regimes most growing businesses touch

Most growing businesses are touched by three or four regimes at once, usually because of where their customers live rather than where they are registered. The table below sticks to figures published by the regulators themselves.

Two practical notes. The ceiling is not the expectation: the vast majority of enforcement against small and mid-sized firms is a reprimand, an order to change a practice, or a fine far below the maximum. And the US picture keeps moving, with the IAPP’s tracker updated as each state law takes effect, so treat any list of states you read, including one in a blog post, as a snapshot rather than a standing fact.

Six jobs that cover most of the ground

1. Name an owner. One person accountable, with a standing 30 minutes a month. If your processing is large-scale or sensitive you may need a formal Data Protection Officer; most small B2B firms do not, but they still need a name on the door.
2. Finish the data map and re-check it twice a year. Add a column for the contract that covers each processor.
3. Cut access. Remove admin rights nobody uses, turn on multi-factor authentication everywhere it exists, and run a leavers checklist. This is the control customers ask about most often and the one that pays back fastest.
4. Write the retention rules down and automate the deletions you can. A 90-day log retention and a 36-month inactive-contact purge are easier to defend than “we keep everything”.
5. Have a breach procedure with names, phone numbers and a decision point for notifying. Our guide to building a simple incident response plan covers the shape of it: how to build a simple incident response plan.
6. Keep the evidence. Screenshots of settings, dates of access reviews, training completion, processor contracts. Compliance is largely the ability to show your working a year later.

That list is deliberately boring. None of it requires a consultant, a certification or a platform subscription, and all of it is work an in-house team can do with help on the technical pieces. If someone is selling you a compliance tool before you have a data map, you are buying a dashboard for data you have not inventoried.

The 72-hour clock, and why it catches people out

Under the UK GDPR you must report a notifiable personal data breach to the ICO within 72 hours of becoming aware of it, where feasible, and the ICO is explicit that you should notify even if you do not yet have all the details. The EU position is the same 72 hours to your supervisory authority, with notification to affected individuals without undue delay where the risk to them is high. The ICO also warns that failing to notify when required can attract a fine of up to £8.7 million or 2% of global turnover, separate from any penalty for the breach itself.

Awareness is the part people get wrong. If a developer notices on Friday evening that a storage bucket has been public for a month, the clock did not start on Monday morning when the managing director was told. Build the escalation path so that anyone who spots something has one obvious person to call, and so that person knows the deadline. Also note the August 2025 change in the UK: the Data Use and Access Act moved PECR breach reporting from 24 hours to 72, aligning it with the UK GDPR, which removed a trap that used to catch marketing teams.

Where the money goes

For a company under a hundred people, the realistic budget is mostly time plus a few subscriptions you probably already pay for. The expensive scenario is the one you avoid: IBM’s 2026 Cost of a Data Breach Report puts the global average cost of a breach at a record USD 4.99 million, 12% up on the previous year, driven by higher detection, escalation and lost-business costs. That average is dominated by large enterprises, so do not read it as your exposure. Read the composition instead, because the same report attributes 63% of breach cost to detection and escalation plus lost business, and both of those are things preparation genuinely reduces.

The costs that land on growing businesses are duller and more certain: the security questionnaire that holds up an enterprise deal for six weeks, the penetration test a customer insists on, the week of engineering time to add single sign-on, the insurance renewal that now asks whether you have MFA on remote access. Doing the six jobs above turns each of those from a scramble into a form-filling exercise. Our work on securing remote and hybrid teams covers the access-control half, and business continuity planning covers what happens when prevention fails.

Mistakes we see most often

• Buying a cookie banner and calling it done. Consent tooling is the visible 10%. Nobody has ever been fined for an ugly banner on top of a tidy data estate.
• Signing processor contracts nobody reads. If a vendor processes your customers’ data, you need a data processing agreement and some idea of where their servers are.
• Treating backups as outside scope. Deletion requests apply to copies too. Decide now how a deletion propagates to backups, and write down the honest answer, including the lag.
• Over-collecting at the form. Every optional field you remove is less data to protect, map, disclose and delete.
• Running training once. People forget. Twenty minutes twice a year beats a two-hour session at induction and nothing after.

Our cybersecurity service delivers this work remotely, worldwide: we run the data mapping workshop over a call, do the access-control tightening in your tenancy, and leave you with the evidence pack and the procedure. If you are in Sri Lanka and want someone on site, that is what eudora.lk is for.

Want a data map and a defensible breach procedure without hiring a compliance team? Get in touch with Eudora Technology to talk about your project.