A one-person company does not get a separate version of the GDPR. It does get to build proportionate controls around a simpler operation.
The useful goal is not a folder of generic policies. It is a small system in which you know what data enters the product, why it is used, who receives it, when it is removed, and how you will respond when something goes wrong.
Confirm whether the GDPR applies
The Regulation applies to an establishment in the EU when it processes personal data in that context. It can also apply to an organisation outside the EU when it offers goods or services to people in the EU or monitors their behaviour there. Article 3 of the GDPR contains the full territorial test.
One accidental EU visitor does not by itself prove that a non-EU product is offering services to the EU. Currency, language, marketing, customer acceptance, and tracking choices can be relevant. Record the scope decision instead of relying on the server location.
Build a minimum evidence pack
1. Map the data
List each source and destination:
- account and authentication fields;
- billing records;
- product content and uploads;
- support messages;
- analytics and logs;
- email and marketing tools;
- AI providers and any prompts; and
- backups and deletion queues.
For every purpose, record the data subjects, fields, recipient, location, retention rule, Article 6 basis, and any Article 9 condition. This becomes the working source for notices, processor reviews, and deletion jobs.
2. Minimise before documenting
Remove fields that are not needed. Avoid personal data in URLs and logs. Give uploads a clear size, type, and retention rule. Decide whether an AI feature really needs the submitted content and whether a provider may train on it.
3. Choose a basis purpose by purpose
Contract may cover processing objectively necessary to deliver what the user requested. Legal obligation may cover some tax records. Consent can cover a genuinely optional use. Legitimate interests require a documented purpose, necessity, and balancing assessment. Do not use one basis for the whole product.
4. Publish accurate notices
Articles 13 and 14 require information about the controller, purposes, bases, recipients, transfers, retention, rights, complaints, and other relevant facts. A privacy notice should describe the live system. A cookie notice should reflect a verified storage scan.
5. Control processors and transfers
Keep a vendor register. Identify which suppliers act as processors, sign Article 28 terms, review subprocessors, and document any Chapter V transfer mechanism. A vendor privacy policy is not a substitute for your own contract and assessment.
6. Make rights executable
Create a route for access, correction, deletion, restriction, portability, and objections. Know where to search and how to verify identity proportionately. Test the process with a real test account.
7. Define retention and incident response
Replace “as long as necessary” with a period or a usable decision criterion. Apply the rule to production, logs, support systems, and backups.
Write down who assesses a personal-data breach, what evidence is preserved, and how the 72-hour supervisory-authority deadline in Article 33 is handled when notification is required. The EDPB’s SME breach guide provides a practical starting point.
Checks that are conditional, not optional to consider
- A record of processing activities may still be required below 250 employees when processing is not occasional, creates a risk, or includes special-category or criminal-offence data.
- A data protection impact assessment is required for processing likely to create high risk. The EDPB explains the DPIA process.
- A data protection officer is required in the Article 37 cases, including certain large-scale regular monitoring or large-scale special-category processing.
- A non-EU controller or processor within Article 3(2) may need an EU representative under Article 27.
Do not dismiss these checks because the team is small.
A release routine
Before each material feature release:
- Update the data map and threat model.
- Confirm the bases and notices.
- Review any new vendor and transfer.
- Add deletion and export coverage.
- Test privacy settings and consent controls.
- Decide whether the change triggers a DPIA or specialist review.
- Record the decision and the evidence used.
GDPR.Direct can turn business facts into editable document drafts and a hosted legal hub. It cannot inspect your architecture, negotiate vendor terms, operate rights workflows, or decide a contested legal classification. Keep a human owner for those controls.
This article is educational information, not legal advice.
