GDPR compliance is often treated as a large-company problem — something handled by a dedicated legal and compliance department. In reality, GDPR applies just as much to a two-person software company in Sweden building a SaaS product as it does to a large enterprise, and the penalties for non-compliance do not scale down with company size. For small teams, the challenge is doing this properly without a dedicated legal department.

Start With What Data You Actually Collect

Before writing a single policy document, map out, concretely:

  • What personal data your product or website collects (names, emails, IP addresses, usage analytics, payment details)
  • Where it is stored, and which third-party services (analytics providers, payment processors, hosting providers, email tools) touch that data
  • How long you actually need to keep it

Most small companies are surprised, once they do this exercise, by how many third-party tools are quietly processing user data — analytics scripts, ad networks, form providers — each of which needs to be accounted for in your privacy documentation.

The Core Documents Every Small Company Needs

  • A Privacy Policy — describing what data is collected, why, how long it's retained, and what rights users have over it (access, correction, deletion)
  • A cookie/consent notice — if your site uses analytics, advertising, or any non-essential cookies, EU law generally requires clear consent before those cookies are set, not just a passive notice
  • Data processing agreements (DPAs) with any third-party vendor that processes personal data on your behalf — most major cloud and SaaS providers offer a standard DPA you can sign

Practical Rights You Need to Be Able to Honour

GDPR gives individuals specific rights, and as a data controller you need a real (even if manual, for a small team) process to fulfil them:

  • Right of access — someone can ask what data you hold on them
  • Right to rectification — they can ask you to correct inaccurate data
  • Right to erasure — the "right to be forgotten," subject to certain legal exceptions (e.g. data you're required to retain for accounting purposes)
  • Right to data portability — providing their data in a portable format on request

For a small team, this doesn't need automated tooling on day one — a documented internal process (who handles the request, within what timeframe — 30 days under GDPR — and how) is enough to start.

Common Mistakes Small Teams Make

  • Copy-pasting a generic privacy policy template without actually matching it to what data is collected in practice
  • Using analytics or ad tools that set cookies before consent is given, rather than after
  • Storing more data for longer than actually needed, "just in case," which increases both legal exposure and breach impact
  • Not having a written data breach response plan — GDPR requires notifying relevant authorities within 72 hours of becoming aware of a qualifying breach

The Practical Bottom Line

GDPR compliance for a small software company is less about legal complexity and more about honest bookkeeping: know what data you have, why you have it, who else touches it, and have a real process for handling requests about it. Getting these fundamentals right early is far cheaper than retrofitting compliance after a regulator inquiry or a user complaint.