Data protection in craft businesses: what's really needed
A roofing company, a bakery, an electrical contractor, a small marketing agency — they all process personal data. Customer names, addresses, bank details, email addresses, employee data. GDPR applies to everyone.
But: the requirements are proportionate. What a corporation with 10,000 employees and an in-house IT department needs is not the same as what a craft business with 8 employees needs.
We help you understand the difference — and implement only what's actually necessary and proportionate.
Typical data protection topics for craft businesses and SMEs
Customer data and order management
Customer names, addresses, phone numbers, payment data: you process this data every day. You need a legal basis (usually contract performance), a record of processing activities, and clear rules for retention and deletion.
When must customer files be deleted? The tax retention period is 10 years — after that, data should be deleted unless there is another reason to retain it.
Employee data
Payroll accounting, time tracking, sick notes, applicant data — all of this is personal data. Craft businesses often use external payroll offices or tax advisors, which requires Data Processing Agreements.
Website and online presence
Do you have a contact form? Google Analytics? A Facebook page? Then your privacy notice needs to be correctly drafted and cookie consent correctly obtained. That sounds like a lot of work, but it's done in a few hours — once you know what you're doing.
Email marketing and newsletters
Many craft businesses send offers, reminders, or seasonal information by email. That's allowed — but under certain conditions. Obtain consent, provide an unsubscribe option, document opt-ins.
Monitoring and video surveillance
Do you have a camera at the entrance or in the warehouse? Then data protection requirements apply: signage obligations, limited retention periods, information obligations.
Frequently asked questions from practice
"We've never received a warning notice — is this really necessary?"
Yes. Regulatory inspections and complaints from employees or customers are increasing. And anyone who has already experienced a data breach (a lost USB stick with customer data, a hacked email account) understands why it matters.
"We're too small to be interesting to anyone."
Unfortunately not true. Automated attacks don't distinguish by company size. And in the case of complaints from customers or employees, the size of the company is irrelevant.
"What does it cost?"
For a small craft business, solid initial documentation can typically be completed within a couple of dozen hours of work. Fixed-price packages provide planning certainty. In the initial consultation, we'll give you a concrete price.
What we do for you
We take a look at your business — without assuming prior knowledge, without jargon. Then we show you:
- What you need to do immediately
- What you should tackle in the next 3 months
- What you can skip
Data protection in a small business isn't rocket science. With the right overview, it's a manageable project.