In practice the GDPR asks three things of a mid-market company: to know what personal data you hold and why, to protect it with reasonable technical and organisational measures, and to be able to react if something goes wrong. Everything else — records, policies, consents — serves those three. The companies that fail are usually not the ones with the smallest budget, but the ones that treat the GDPR as a one-off folder of documents rather than a way of working.

What does the GDPR actually demand of a mid-market company?

The regulation does not require expensive software or an army of lawyers. It requires you to have control over the personal data you process. That means being able to answer four simple questions: what data do you hold, where is it stored, who has access to it, and how long do you keep it. If you cannot answer confidently, you do not have a documentation problem — you have a visibility problem. And it is precisely that visibility, not another signed declaration, that protects you during an inspection or a real breach.

In practice, compliance rests on two pillars. The organisational pillar is the rules: who may do what with the data, how you train people, what happens when an employee leaves. The technical pillar is the measures that actually protect the data — access control, encryption, backups, separation of rights. Much of the technical pillar overlaps with ordinary good cyber hygiene, which is why our cybersecurity service and GDPR compliance go hand in hand.

Which personal data are you processing without noticing?

The first step towards compliance is an inventory — a list of every place where personal data lives. Most companies are surprised how many there are. It is not just the customer base in the CRM. Personal data sits in accounting (national ID numbers, bank accounts), in HR files (employment records, health information), in the sales team's inboxes, in spreadsheets on desktops, in the website's contact forms, in camera recordings and in the access-pass system.

Map it honestly, process by process. For each category of data write down: why you collect it (the legal basis), where it is stored, who has access, and when it must be deleted. This map is the foundation of everything that follows — without it, policies are just text that does not describe reality.

Which technical measures cover the most risk?

Not all measures are equally effective. If you have limited budget and time, here is the order that covers the most risk with the least effort:

1. Multi-factor authentication. The cheapest measure with the biggest effect. Even a stolen password does not open access when there is a second factor. We look at it in detail in MFA: the cheapest protection most companies skip.

2. Order in passwords. Shared passwords in a spreadsheet are a breach waiting to happen. We describe the right approach in Passwords and password managers for companies.

3. A trained team. Most breaches begin with a person who clicks where they should not. How to prepare your people is explained in Phishing: training your team to spot it.

4. Backups and access control. Data must survive both a hardware failure and ransomware, and access to it should be given only to the people who genuinely need it for their work.

What should you do in the event of a data breach?

The GDPR requires that, in the event of a breach that threatens people's rights, you notify the supervisory authority — as a rule within a short window after discovering it — and in more serious cases the affected individuals themselves. This only sounds stressful if you have no plan. The companies that react calmly are the ones that wrote the procedure in advance: who leads the response, whom we notify, what we document.

Breach notification is therefore not a standalone topic but part of your wider incident readiness. If you have not built any yet, start with an independent assessment — Cybersecurity audit: how it works and what you get shows you where to begin.

What rights do people have and how do you serve them?

The GDPR gives everyone specific rights over their data: to request a copy of it, to correct it, under certain conditions to ask for its deletion, and to withdraw a consent they have given. For a mid-market business the point is not to memorise them, but to have a clear internal routine — who handles such a request, how you verify the sender's identity, and within what deadline you respond. A request that gets buried in a shared inbox and left unanswered is just as much a problem as a technical breach.

This is where the inventory pays off a second time. If one customer's data is scattered across the CRM, accounting, three spreadsheets and someone's inbox, even a simple "give me a copy of my data" turns into days of manual searching. When you know where each category of data lives, serving a single right is a matter of minutes rather than panic — which is why order over your data is a practical benefit, not merely a formality.

How do you keep the GDPR from becoming dead paper?

The most common mistake is to pay for a pack of documents, sign them, and forget them in a drawer. A year later the reality of the business no longer matches what the folder says — new systems, new people, new processes. Compliance is not an event but maintenance: you review the data map once a year, update rights when the team changes, and check whether the measures still work.

For companies that fall within the new network and information security requirements, maintenance matters even more — the amendments to the Cybersecurity Act are in force from 17 February 2026. We describe a practical path through them in NIS2 compliance: the complete 2026 checklist. For most mid-market companies the good news is that GDPR and cybersecurity measures overlap — once built, they work for both.

Frequently asked questions