The GDPR applies to every business, without exception
Contrary to a persistent belief, the GDPR does not only target large companies. Any organisation that collects personal data (even just a contact form, a newsletter or a customer file) falls within its scope, whether it is based in the European Union or targets people in it. The size of the business does not change the principle; it only shapes the practical steps towards compliance.
What the French regulator's 2025 record reveals about SMEs
Each EU member state has its own supervisory authority, and France's CNIL is among the most active. Its figures for last year confirm that small businesses are no longer spared, provided you read the right indicators. CNIL sanctions peaked in 2025 at around half a billion euros in total, against 55 million in 2024. But this spectacular jump is mainly due to a few mega-fines against digital giants such as Google and Shein: it says little about the real risk for a small business. The signal that genuinely concerns small organisations lies elsewhere, in the growth of the simplified procedure designed for them.
The key figures:
CNIL sanctions in 2025, including mega-fines against giants (Google, Shein): around half a billion euros.
Total amount in 2024, for comparison: 55.2 million euros.
Decisions taken by the CNIL in 2025: 259, of which 83 were sanctions.
Share of inspected companies that were small or very small businesses: 32%.
Maximum fine under the simplified procedure (aimed at small organisations): 20,000 euros.
Sanctions under the simplified procedure over the year: 69.
The simplified procedure, capped at a 20,000 euro fine, specifically targets modest-sized organisations, with 69 sanctions handed down this way in 2025. The three most frequently sanctioned failings remain basic: insufficient data security (14 organisations sanctioned), failure to respond to the regulator's requests (14 organisations) and failure to act on erasure or access requests (14 decisions). These are not elaborate frauds but structural oversights that are easy to fix once identified. Other European regulators apply the same GDPR, and these failings are just as likely to be picked up elsewhere.
The fundamental obligations
Records of processing activities: document each processing of personal data, with its purpose, legal basis, categories of data, recipients and retention period. It is the backbone of your compliance and the first thing a regulator asks for during an inspection.
Collecting consent: for non-essential cookies and marketing, consent must be freely given, informed and as easy to refuse as to accept. Pre-ticked boxes and misleading banners are prohibited.
Informing people: publish a clear, accessible and up-to-date privacy policy explaining what data you collect, why and for how long.
Respecting rights: be able to answer an access, rectification or erasure request within one month. Failing to answer a regulator's request was among the three most sanctioned failings in France in 2025.
Data security: encrypt sensitive data, limit access to what is strictly necessary, and notify the supervisory authority of a breach within 72 hours. This is the failing most frequently found among sanctioned small businesses.
What a regulator checks first during an inspection
The three failings most often sanctioned under the French simplified procedure outline the points an inspection examines first. On data security, the regulator generally checks the encryption of sensitive data, the strength of passwords and the existence of backups. On responsiveness to the regulator itself, a simple failure to reply within the set deadline is enough to constitute a sanctionable failing, regardless of how serious the original matter was. On requests from data subjects (access, rectification, erasure), the regulator checks not only that the business responds, but that it responds within the one-month deadline laid down by the regulation, which means being able to find a given person's data quickly across all its systems.
Data minimisation, an often neglected principle
One simple rule sums up the spirit of the GDPR: collect only the data you really need, and keep it only as long as necessary. Many small businesses hoard data just in case: customer files never purged, CVs kept for years. Yet every piece of data held is both a responsibility and a risk in the event of a leak. Sorting through it regularly reduces your exposure as much as your compliance workload.
The question of processors
If you entrust data to service providers (hosting company, email marketing tool, management software), you remain responsible for how it is processed. The GDPR requires these relationships to be governed by contractual clauses and requires you to ensure your partners offer sufficient guarantees. It is a frequently forgotten point, and it ties in with the supply chain security requirements of the NIS2 directive.
The actual sanctions
Under the GDPR, a fine can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher. But for the vast majority of small businesses inspected in France, it is the simplified procedure that applies, with a fine capped at 20,000 euros: far from the headline records, but very real and increasingly common. Beyond the fine, a sanction is often made public: the damage to reputation can cost more than the penalty itself.
Taking action
An initial GDPR audit identifies the gaps, prioritises corrective actions and builds the mandatory documentation. This structured approach protects your business and provides a trust argument with your customers and partners. Some complex or sensitive processing may require appointing a DPO or seeking advice from a specialist lawyer, beyond the technical and organisational support we provide. The good security habits described in our SME security audit checklist are its natural complement.
A DPO is not always mandatory
Appointing a data protection officer (DPO) often worries the heads of small businesses, who imagine it to be costly and complex. Yet it is only mandatory in specific cases: large-scale processing of sensitive data, systematic monitoring of individuals, or a core activity that requires it. Most small organisations, whose data processing remains conventional (customer file, payroll, prospecting), are not required to have one.
That does not exempt them from organising their compliance, but structured GDPR support, one-off or recurring, is generally enough to cover the essentials without appointing a full-time DPO. The real question is not whether you need a DPO, but who, inside or outside the business, makes sure the obligations are met and documented.
Compliance as a trust argument
The GDPR is often experienced as a constraint, rarely as an opportunity. Yet it has become a concrete commercial argument. More and more customers, especially in business-to-business and the public sector, require data protection guarantees from their suppliers before signing: a security questionnaire, a contract clause, sometimes an audit. A small business able to show up-to-date records, a clear policy and documented security measures gets a head start over a competitor who discovers the subject when it is time to answer.
Becoming compliant is therefore not just about avoiding a sanction, it is about becoming easier to choose. In a supply chain where everyone passes their requirements on to their own suppliers, compliance becomes a passport as much as a protection.
Oversights that can be fixed
The most reassuring point in the French regulator's record is that the most sanctioned failings are not elaborate frauds but structural oversights: insufficient security, a request left unanswered, an access right ignored. All of these can be fixed once identified, without turning the business upside down. What matters is not to wait for an inspection to notice them. To take stock, discover our GDPR compliance support or contact us.
Sources: RGPDKit, GDPR 2025: 1.15 billion euros in fines · CNIL, sanctions issued by the CNIL