GDPR Guide 2026: Obligations, Fines, Practical Roadmap for SMBs

This guide gives the overall picture of the GDPR for small and medium-sized enterprises in Germany and Austria. The individual obligations are covered in depth by the specialist articles in the GDPR topic area; where a section stays short here, a link leads to the detailed article.

What is the GDPR?

The General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) has applied directly in all EU Member States since 25 May 2018 (Art. 99(2) GDPR). It protects natural persons with regard to the processing of their personal data and at the same time governs the free movement of such data within the Union (Art. 1 GDPR). Transposition into national law is not required; the Member States may, however, add rules where the regulation contains opening clauses.

In Germany the Federal Data Protection Act (BDSG) supplements the regulation, for example with rules on data processing in the employment context (§ 26 BDSG), on the designation of a data protection officer (§ 38 BDSG) and on the supervision of non-public bodies (§ 40 BDSG). For cookies and other access to terminal equipment, § 25 TDDDG applies. In Austria the Data Protection Act (DSG) supplements the regulation; the rule on storing information in, and accessing, terminal equipment is set out in § 165(3) TKG 2021.

Status 2026: what applies and what is only a proposal

• Digital Omnibus on data: on 19 November 2025 the Commission proposed amending, among other things, the GDPR and the ePrivacy Directive (COM(2025) 837, procedure 2025/0360(COD)). The procedural status reads “Awaiting committee decision”; as at 17 August 2026 no legal act was in force. Art. 30(5) GDPR and all other obligations therefore apply unchanged.
• Not to be confused: the AI part of the Digital Omnibus has been in force as Regulation (EU) 2026/1744 since 27 July 2026. It amends the AI Act, not the GDPR.
• Third-country transfers to the US: the adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) applies; the action against it was dismissed, and the appeal is pending (details in the section on third-country transfers).
• Guidelines: the EDPB Guidelines 1/2024 on legitimate interest are available in consultation version 1.0; a final version is not documented in the sources evaluated. For cookies and digital services, the guidance of the German supervisory authorities (DSK) on § 25 TDDDG, “OH Digitale Dienste”, in version 1.2 (November 2024) is the current version.

Central: the GDPR is applicable law for every controller, regardless of the size of the company. The controller must not only comply with the principles of Art. 5 but also be able to demonstrate compliance (accountability, Art. 5(2) GDPR).

The 7 principles under Art. 5 GDPR

Art. 5 GDPR is the foundation of all further obligations. Every processing operation must satisfy all principles at the same time:

1. Lawfulness, fairness and transparency (Art. 5(1)(a)): a legal basis under Art. 6(1) GDPR is required, that is consent, contract, legal obligation, vital interests, a task carried out in the public interest or legitimate interests. For special categories such as health data, the general prohibition of processing in Art. 9(1) additionally applies, with the exceptions in Art. 9(2).
2. Purpose limitation (point (b)): data are collected for specified, explicit and legitimate purposes. Where a new purpose is to be added, compatibility must be assessed under Art. 6(4).
3. Data minimisation (point (c)): only the data that are necessary for the purpose.
4. Accuracy (point (d)): data must be accurate and, where necessary, kept up to date.
5. Storage limitation (point (e)): data are kept in identifiable form only for as long as is necessary for the purpose. In practice this requires an erasure concept with retention periods.
6. Integrity and confidentiality (point (f)): appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.
7. Accountability (Art. 5(2)): the controller is responsible for compliance and must be able to demonstrate it. That is why data protection in practice is above all documentation.

Who is bound by the GDPR?

The GDPR is tied to roles, not to size or sector. Two roles are decisive for companies.

Controller (Art. 4(7) GDPR)

The controller is whoever, alone or jointly with others, determines the purposes and means of the processing. This concerns companies of every size, associations, the self-employed and members of the liberal professions. For private controllers, the most important exception is processing by a natural person in the course of a purely personal or household activity (Art. 2(2)(c) GDPR).

Processor (Art. 4(8) GDPR)

A processor is whoever processes personal data on behalf of the controller, that is on the controller's instructions. Typical examples are cloud and hosting providers, IT service providers with remote maintenance access, providers of HR or newsletter software and external payroll services that work to the employer's specifications. The controller may only use processors that provide sufficient guarantees of appropriate technical and organisational measures, and must govern the cooperation in a contract under Art. 28(3) GDPR.

Not every external service provider is a processor. The external data protection officer performs a separate statutory function (Art. 37 to 39 GDPR) and does not process on behalf of the controller. Professionals such as tax advisors or lawyers who handle mandates on their own responsibility are independent controllers for the client data; a data processing agreement is then not the right type of contract. The distinction is explained in the article GDPR for tax advisors and law firms.

Territorial scope (Art. 3 GDPR)

• Establishment principle (Art. 3(1)): the GDPR applies to any processing in the context of the activities of an establishment in the Union, regardless of where the processing technically takes place.
• Market location principle (Art. 3(2)): controllers and processors without an establishment in the Union also fall under the GDPR where they offer goods or services to data subjects in the Union or monitor their behaviour in the Union. As a rule they must designate a representative in the Union (Art. 27 GDPR).

The 8 central core duties

Two further duties cut across all processing operations: the information obligations towards data subjects at the time of collection (Art. 13 and 14 GDPR), implemented above all through privacy notices and information sheets, and the rules on transfers to third countries (Art. 44 to 49 GDPR).

Fines and liability

The GDPR has two tiers of fines. In each case the higher of the two amounts is decisive.

Two judgments of the CJEU shape liability. Under the judgment of 5 December 2023 (C-807/21, Deutsche Wohnen), a fine may be imposed on a company without the infringement first having been attributed to an identified natural person; it must, however, be shown that the infringement was committed intentionally or negligently. Alongside fines there are claims for damages by data subjects under Art. 82 GDPR: under the judgment of 4 May 2023 (C-300/21, Österreichische Post), a mere infringement does not in itself give rise to a claim, but non-material damage need not reach a threshold of seriousness.

Current fine cases

Individual fine decisions with amounts, supervisory authorities and the status of proceedings are listed in the GDPR fines tracker 2025/26; it also covers cases from the SME sector. How proceedings run after a complaint and which rights companies have in them is explained in the article on the GDPR fining procedure. A first indication of the order of magnitude is provided by the fine calculator.

10-step practical roadmap

A pragmatic implementation for medium-sized companies plans with three to four months where the work is prioritised. The week figures are planning values from practice, not statutory deadlines.

1. Inventory (weeks 1 to 2): which personal data do we process, in which systems, with which data flows inwards and outwards?
2. Record of processing activities (weeks 2 to 4): record all activities with the information under Art. 30(1) GDPR (purposes, categories of data subjects and data, recipients, third-country transfers, where possible time limits for erasure and a description of the TOMs); additionally note the legal basis so that it can be demonstrated (Art. 5(2) GDPR).
3. TOM concept (weeks 3 to 4): define measures according to risk and provide for regular testing of their effectiveness (Art. 32 GDPR). What an auditable structure looks like is shown in the TOM checklist.
4. Review processing on behalf (weeks 4 to 6): cloud and hosting providers, IT maintenance, HR and newsletter software: is there a contract under Art. 28(3) for every processor, and is it up to date? Professionals acting as independent controllers do not belong on this list.
5. Information obligations (week 5): privacy notice for website and app as well as information for employees, applicants, customers and suppliers under Art. 13 and 14 GDPR.
6. Check the DPO obligation (week 5): check the obligation under Art. 37 GDPR and, in Germany, under § 38 BDSG; where it applies, designate a DPO, publish the DPO's contact details and communicate them to the supervisory authority (Art. 37(7) GDPR).
7. Process for data subject rights (weeks 6 to 8): who receives requests, who verifies identity, who responds? Build the one-month period of Art. 12(3) GDPR and the option of extending it by two months into the process.
8. Process for personal data breaches (weeks 7 to 8): reporting chain with responsibilities and deputies, risk assessment, notification without undue delay and, where feasible, within 72 hours; document every breach internally, even where no notification is required (Art. 33(5) GDPR).
9. Secure third-country transfers (weeks 8 to 10): for US recipients, check whether they are on the Data Privacy Framework List; otherwise appropriate safeguards under Art. 46 GDPR, for example standard data protection clauses, with an assessment of the level of protection in the recipient country. Details in the Schrems II and DPF update.
10. Raise staff awareness (weeks 10 to 12): confidentiality undertaking and instruction. The GDPR does not prescribe training as a separate obligation; controllers must, however, ensure that persons acting under their authority process data only on instructions (Art. 32(4) GDPR), and the tasks of a DPO include monitoring compliance, including the awareness-raising and training of staff involved in processing operations (Art. 39(1)(b) GDPR). For implementation there is the GDPR training as an e-learning course.

Third-country transfers: the US and the Data Privacy Framework

Data may be transferred to a third country only where the conditions of Art. 44 to 49 GDPR are met. The simplest route is an adequacy decision of the Commission under Art. 45 GDPR. For the US such a decision exists on the EU-US Data Privacy Framework, Implementing Decision (EU) 2023/1795 of 10 July 2023. It applies, however, only to organisations included in the Data Privacy Framework List maintained by the U.S. Department of Commerce. The Commission monitors the framework on an ongoing basis and may suspend, amend or repeal the decision under Art. 45(5) GDPR.

On the status of proceedings: the General Court of the EU dismissed the action for annulment on 3 September 2025 (T-553/23, Latombe). An appeal against that judgment, C-703/25 P, has been pending before the Court of Justice since 31 October 2025; no decision had been handed down as at 17 August 2026. Anyone using US services should therefore document the basis on which each transfer rests.

Where a recipient is not on the list, appropriate safeguards under Art. 46 GDPR are required, in practice usually the Commission's standard data protection clauses. Since the Schrems II judgment (CJEU, 16 July 2020, C-311/18), the exporter must assess whether the level of protection in the recipient country is essentially equivalent to that in the Union; the same judgment declared the former Privacy Shield decision (EU) 2016/1250 invalid. How the assessment is structured is shown in the section on standard contractual clauses in the Schrems II article.

Do I need a data protection officer (DPO)?

EU-wide, a DPO must be designated under Art. 37(1) GDPR in three cases: for public authorities and bodies, where the core activities require regular and systematic monitoring of data subjects on a large scale, and where the core activities consist of large-scale processing of special categories under Art. 9 or of data relating to criminal convictions under Art. 10. In Germany, § 38(1) BDSG is added: an obligation from, as a rule, at least 20 persons constantly engaged in the automated processing of personal data, and regardless of the number of persons where a processing operation is subject to a DPIA or data are processed commercially for the purpose of transfer or for market or opinion research. Austria provides no numerical threshold; the obligation follows solely from Art. 37 GDPR, and § 5 DSG additionally governs the DPO's duty of secrecy. An obligation solely on account of the sector or from the first employee does not follow from these provisions; what matters is whether the core activity is “large-scale” in the individual case. Anyone who is unsure documents the assessment. Internal and external solutions, tasks and protection against dismissal are covered in the article Data protection officer: when is a DPO required.

Sector practice: five sectors at a glance

The obligations are the same; the focus shifts from sector to sector. The sector articles cover each sector in depth.

• Tax advisors and law firms: client data are subject not only to the GDPR but also to professional secrecy. For handling mandates, the firms are independent controllers; they need data processing agreements with their own service providers, for example for software and hosting. More on this: GDPR for tax advisors and law firms.
• Medical practices, medical care centres and therapists: health data are special categories under Art. 9 GDPR. After an incident such as a ransomware attack, in addition to notifying the supervisory authority it must be assessed whether there is a high risk and patients must be informed under Art. 34 GDPR. More on this: GDPR for medical practices and therapists.
• IT service providers and SaaS providers: they are frequently processors for their customers, need the controller's authorisation for sub-processors (Art. 28(2) and (4) GDPR) and notify personal data breaches to the customer without undue delay (Art. 33(2) GDPR). More on this: GDPR for SaaS providers and GDPR templates for IT service providers.
• E-commerce and online shops: cookies and comparable access to terminal equipment require consent beyond what is strictly necessary, in Germany under § 25 TDDDG, in Austria under § 165(3) TKG 2021. Advertising and newsletters follow their own rules. More on this: Cookie banner under § 25 TDDDG and GDPR in marketing.
• Every employer: in Germany, employee data are to be assessed under § 26 BDSG; monitoring and video surveillance are subject to narrow limits. More on this: Limits of employee monitoring and Video surveillance at the workplace.

CJEU case law with practical consequences (selection)

Four decisions of the Court of Justice are particularly relevant to SMEs in day-to-day work:

• C-311/18 (Schrems II, 16 July 2020): Privacy Shield invalid; where standard data protection clauses are used, the level of protection in the recipient country must be essentially equivalent. Where there is no adequacy decision, the clauses cannot be complied with in the third country and the required protection cannot be ensured by other means, the supervisory authority must suspend or prohibit the transfer, unless the exporter has itself suspended or ended it.
• C-300/21 (Österreichische Post, 4 May 2023): a mere infringement does not yet give rise to compensation under Art. 82 GDPR; a national threshold of seriousness for non-material damage is, however, impermissible.
• C-807/21 (Deutsche Wohnen, 5 December 2023): fines on companies do not require that the infringement first be attributed to an identified natural person, but they do require an intentional or negligent infringement.
• C-634/21 (SCHUFA scoring, 7 December 2023): the automated establishment of a credit score by a credit information agency is itself an automated decision within the meaning of Art. 22(1) GDPR where a third party to whom the score is transmitted draws strongly on it in its contractual decision.

First-measures checklist for SMEs

These twelve points should be in place before an enquiry from the supervisory authority or a data subject arrives:

1. Up-to-date record of processing activities covering all activities (Art. 30 GDPR)
2. Privacy notice on the website and information under Art. 13 and 14 GDPR for employees, applicants, customers and suppliers
3. Consent management for cookies (Germany: § 25 TDDDG; Austria: § 165(3) TKG 2021), without pre-set consent
4. Assessed DPO obligation; where it applies, written designation and communication to the supervisory authority
5. Documented TOMs with testing of effectiveness (Art. 32 GDPR)
6. Data processing agreements with all processors (Art. 28 GDPR)
7. Signed confidentiality undertakings from employees
8. Reporting chain for personal data breaches with the target “without undue delay, where feasible within 72 hours” and an internal register (Art. 33 GDPR)
9. Erasure concept with retention periods (Art. 5(1)(e) GDPR)
10. Process for data subject rights with the one-month period and the extension rule (Art. 12(3) GDPR)
11. Documented basis for every third-country transfer (Art. 44 to 49 GDPR)
12. Regular, documented instruction of employees

If a point is missing, it is the next work step. A quick self-assessment is offered by the 1-minute GDPR quick test.

Common mistakes and misconceptions

• “We are too small”: the GDPR applies regardless of size. The exemption from the record of processing activities for organisations with fewer than 250 employees does not apply where the processing is likely to result in a risk, is not occasional or includes data under Art. 9 or 10 (Art. 30(5) GDPR); ongoing personnel and customer data are, as a rule, not merely occasional.
• “The imprint is enough”: Art. 13 and 14 GDPR require information on purposes, legal bases, recipients, storage period and data subject rights. An imprint does not contain it; in practice a separate privacy notice brings it together.
• “Consent always works”: in the employment relationship, voluntariness must be assessed taking into account the employee's dependency (§ 26(2) BDSG); another legal basis is often more robust.
• “Pre-ticked boxes are sufficient”: consent requires a statement or a clear affirmative action (Art. 4(11) GDPR); in the view of the German supervisory authorities (DSK), pre-ticked boxes or inactivity are not sufficient (OH Digitale Dienste, para. 44). An equivalent option to refuse is required by the German supervisory authorities as a matter of interpretation, not of statutory wording.
• “We handle a breach internally”: notifiable breaches must be notified to the supervisory authority, and every breach must be documented (Art. 33(1) and (5) GDPR).
• “Old Privacy Shield clauses still apply”: Privacy Shield has been invalid since judgment C-311/18; what counts today is the Data Privacy Framework or measures under Art. 46 GDPR.

Further typical mistakes with countermeasures are collected in the article Top 10 GDPR mistakes SMEs make.

Germany and Austria: supervision and national rules

The GDPR applies in the same way in both countries; the supplementary laws and the supervision differ. In Germany, supervision is organised on a federal basis: for non-public bodies, and therefore also for companies, the Land data protection authority competent under Land law is responsible (§ 40(1) BDSG). The data protection supervisory authorities of the Federation and the Länder coordinate in the Data Protection Conference (DSK), whose guidance documents are interpretative aids, not laws. Churches and religious associations may have their own supervisory authorities under Art. 91 GDPR. In Austria, the Data Protection Authority, established as the national supervisory authority, is solely competent for companies (§ 18(1) DSG). For cross-border processing in the Union, the supervisory authority of the main establishment acts as lead authority (Art. 56 GDPR); the supervisory authorities cooperate in the consistency mechanism (Art. 63 GDPR); the European Data Protection Board ensures the consistent application of the regulation (Art. 70(1) GDPR).

Austria-specific questions such as adapting the documents to the DSG are covered in the article GDPR complete package Austria.

Templates and training

Anyone who does not want to build the documentation from scratch will find 69 editable Word, Excel and PowerPoint templates in 16 folders in the GDPR Kit: from the record of processing activities through TOMs, processing on behalf and the DPIA to the notification form for personal data breaches. The kit is available in a version for Germany or for Austria, in three packages from EUR 990 to EUR 1,690 net, one-off, with 12 months of legal-status updates. Staff instruction is supported by the Data Protection E-Learning with 8 chapters in around 45 minutes, as an HTML file or SCORM package for your own LMS and with a certificate of participation, individually from EUR 490 net or in the Complete package. Templates structure the work; they do not replace the assessment of your own case.