Introduction
The General Data Protection Regulation (GDPR) applies to every business processing the personal data of European residents, whatever its size. For Belgian SMEs, compliance can seem complex. It avoids sanctions and strengthens your customers' trust.
This guide explains your obligations and gives you a practical checklist to bring yourself into compliance.
The 6 fundamental obligations
1. Keep a record of processing activities
Every SME must document all the processing of personal data it carries out. This record must include:
- The purposes of the processing
- The categories of data concerned
- The recipients of the data
- The retention periods
- The security measures in place
Tip: the Belgian Data Protection Authority (APD/GBA) devotes a page of its website to the record, with its recommendation on the subject.
2. Inform the data subjects
Your privacy policy must be clear, accessible and complete. It must explain:
- Who you are (identity of the controller)
- Why you collect this data
- How long you keep it
- What the rights of individuals are
Where to display it? On your website, in your forms, in your contracts.
3. Respect the rights of individuals
The GDPR gives individuals several rights:
- Right of access: obtain a copy of their data (reply within one month, extendable by two months if the request is complex, art. 12.3 GDPR)
- Right to rectification: correct inaccurate data
- Right to erasure: request deletion ("right to be forgotten")
- Right to data portability: retrieve their data in a standard format
4. Secure the data
Appropriate technical and organisational measures must be put in place:
- Encryption of sensitive data
- Access management and strong passwords
- Regular and tested backups
- Staff training
- Up-to-date antivirus and firewall
5. Frame your processors
Every service provider accessing personal data must sign a GDPR processing agreement compliant with article 28. Check:
- Your web host
- Your emailing tool
- Your CRM
- Your accountant
6. Notify data breaches
In the event of a data leak, you must:
- Notify the APD/GBA within 72 hours of becoming aware of it, unless the breach presents no risk to individuals (art. 33 GDPR)
- Inform the data subjects if the risk is high (art. 34 GDPR)
- Document the incident in an internal register
Possible sanctions
The Data Protection Authority (APD/GBA) can impose fines of up to, for the most serious breaches (art. 83.5 GDPR):
- 20 million euros or
- 4% of worldwide annual turnover, whichever is higher
The amount takes into account:
- The seriousness of the infringement
- Whether it was intentional or negligent
- The measures taken to mitigate the harm
- Cooperation with the APD/GBA
The decisions published by the Data Protection Authority cover organisations of all sizes, including self-employed persons and small structures. The register of decisions can be consulted on the Authority's website.
Quick compliance checklist
- Record of processing activities up to date
- Privacy policy published on the website
- Cookie banner with prior consent
- Procedure for handling rights requests documented
- Processor contracts (article 28) signed
- Security measures documented
- Team training completed
- Impact assessment (DPIA) for high-risk processing
GDPR FAQ
Must I appoint a DPO?
The DPO (Data Protection Officer) is mandatory if (art. 37 GDPR):
- You are a public authority or body
- Your core activities require regular and systematic monitoring on a large scale
- Your core activities consist of large-scale processing of sensitive data or data relating to criminal convictions
For most SMEs, the DPO is not mandatory but can be useful.
Do SMEs have exemptions?
Not really. The GDPR applies whatever the size:
- The DPO is only mandatory in the cases above
- Businesses with fewer than 250 employees escape the record only if the processing is occasional, without risk and without sensitive data (art. 30.5 GDPR). Managing customers or staff is not occasional.
- The impact assessment is required as soon as a processing operation presents a high risk, whatever the size of the business (art. 35 GDPR)
How much does compliance cost?
It all depends on the number of processing operations and their sensitivity. At the firm, fees excl. VAT follow three ranges:
- Getting compliant (privacy and cookie policy, processing agreement): 890 to 1,450 euros
- Taking stock (audit, record, impact assessment): 1,500 to 3,400 euros
- Compliance programme: from 4,000 euros
The details are on the GDPR and external DPO page.
How long does it take to become compliant?
- Initial audit: 1 week
- Mandatory documents: 2 to 4 weeks
- Team training: 1 day
- Total: 1 to 2 months
Conclusion
GDPR compliance is not an option but a legal obligation. It also strengthens the trust of your customers and your contracting partners.
The 3 priorities to start with:
- Draw up your record of processing activities
- Publish a complete privacy policy
- Put up a compliant cookie banner
A legal scoping secures the compliance work and avoids the most frequent mistakes.
Need a GDPR audit?
I handle GDPR compliance for Belgian SMEs. Book a scoping call to assess your situation.
Translated from the French original published on 20 January 2026. The analysis concerns Belgian and European Union law. Read the French original.