Top 10 GDPR Mistakes SMEs Make in 2026

Each of the ten points names the obligation, the provision it follows from, and the measure. The legal references name the respective legal act; the full texts listed in the sources section are linked there where a full text is available. For fines, the article states the statutory ranges under Art. 83 GDPR, not average values. Where German and Austrian law diverge, both jurisdictions are named separately.

1. Treating the RoPA as a 'one-off Excel file'

The record of processing activities is a living document. Practical rhythm: a quarterly review, plus a review for each new processing operation (practical recommendation; no statutory deadline is established here).

The obligation follows from Art. 30(1) GDPR: each controller maintains a record of all processing activities under its responsibility. Art. 30(1)(a) to (g) lists seven mandatory items; because (c) bundles two points — categories of data subjects and categories of personal data — practice derives eight mandatory fields from it, supplemented by the legal basis as a ninth:

1. name and contact details of the controller and, where applicable, of the representative and of the data protection officer
2. purposes of the processing
3. categories of data subjects
4. categories of personal data
5. categories of recipients
6. third country transfers together with safeguards
7. envisaged time limits for erasure
8. general description of the technical and organisational measures
9. legal basis — a field used in practice, not named in Art. 30(1), derived from the accountability obligation under Art. 5(2) GDPR

Anyone processing on behalf of a controller additionally maintains the shorter record under Art. 30(2)(a) to (d) GDPR: name and contact details of the processor and of each controller, categories of processing carried out on behalf of each controller, where applicable third country transfers including documentation of suitable safeguards, and — where possible — a general description of the technical and organisational measures under Art. 32(1) GDPR.

The exemption in Art. 30(5) GDPR applies only cumulatively: fewer than 250 employees and no risk to the rights and freedoms of data subjects and no regular processing and no special categories under Art. 9 or criminal-offence data. The wording refers to 'a risk', not to a high risk — the 'high risk' threshold applies solely to the impact assessment under Art. 35(1) GDPR. Payroll, CRM and newsletters are regular processing operations; in practice, therefore, the exemption ceases to apply from the first employee with customer contact.

Austria: Art. 30 GDPR applies with identical wording — the same mandatory items, no different thresholds or deadlines. The only difference is supervision: the Austrian Data Protection Authority (Datenschutzbehörde) alone is competent (§ 18(1) of the Austrian Data Protection Act (DSG)).

Fix (practical recommendation): a quarterly RoPA review in the compliance calendar, plus ad hoc reviews for new IT systems and processors. Order of examination by the authorities according to practical experience: RoPA → DPA → TOMs → DPIA.

2. No DPA with standard SaaS providers

Microsoft 365, Salesforce, HubSpot, Mailchimp — all processors. Without a DPA: an infringement of Art. 28. Fine up to EUR 10 million / 2%.

Art. 28(1) GDPR permits cooperation only with processors providing sufficient guarantees of appropriate technical and organisational measures. The processing must be governed by a contract or other legal act setting out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller (Art. 28(3) GDPR). The fine range for infringements of Art. 25 to 39 GDPR is up to EUR 10 million or 2 % of the total worldwide annual turnover of the preceding financial year — whichever is higher (Art. 83(4) GDPR).

Two frequent RoPA defects concern the DPA directly: processing on behalf is confused with joint controllership under Art. 26 GDPR, and service providers that have been replaced remain in the record as recipients. Every DPA entry should therefore be mirrored against the recipient list in the RoPA.

Austria: there is no special Austrian rule for processing on behalf; Art. 28(1) and (3) GDPR apply. In addition, § 6 DSG obliges controllers, processors and their staff to observe data secrecy.

Fix (practical recommendation): a DPA inventory per tool: obtain the provider's standard DPA, check it against the minimum content of Art. 28(3) GDPR (subject matter and duration, nature and purpose, type of personal data, categories of data subjects, rights and obligations of the controller), record the sub-processor list and any third country element, document the version and approval date, and mirror the entry against the recipient list in the RoPA.

3. Cookie banners without equal choice

'Accept' green and large plus 'Reject' as a link = a dark pattern. Statutory fine range: up to EUR 300,000 for storing or accessing information without consent (§ 28(1) no. 13, (2) TDDDG), in addition Art. 83 GDPR.

The legal anchor in Germany is § 25(1) TDDDG: storing information in the end user's terminal equipment and accessing information already stored there are permitted only where the end user has consented on the basis of clear and comprehensive information; information and consent must be provided in accordance with the GDPR. Without consent, two cases remain permissible under § 25(2) TDDDG: where the sole purpose is carrying out the transmission of a message, and where access is strictly necessary in order to provide a digital service expressly requested by the user.

Two requirements follow from the GDPR standard, and banners regularly fail them in practice: the controller must be able to demonstrate that consent was given (Art. 7(1) GDPR), and withdrawal must be as easy as giving consent (Art. 7(3) GDPR). A banner that allows consent with a single click but moves withdrawal into a submenu conflicts with that standard.

Austria: the TDDDG applies only in Germany. For tracking cookies, § 165 TKG 2021 requires opt-in consent in Austria; the standard for consent remains that of the GDPR.

Fix (practical recommendation): a banner audit with the same size, colour and position for both buttons. In practical terms this means: reject on the same level as accept, that is, without an additional click; the same font size and button area; no colour contrast favouring one option. Add a withdrawal point that is reachable at any time, so that withdrawal remains as easy as giving consent (Art. 7(3) GDPR).

4. Personal data breach not notified within 72 hours

Art. 33 GDPR: a 72-hour notification deadline. Statutory fine range for infringements: up to EUR 10 million or 2 % of worldwide annual turnover (Art. 83(4) GDPR).

The period runs from awareness: the controller notifies without undue delay and, where feasible, within 72 hours after having become aware of the breach — unless it is unlikely to result in a risk to the rights and freedoms of natural persons. Where the deadline is exceeded, the notification must be accompanied by reasons for the delay (Art. 33(1) GDPR). Where a high risk is likely, communication to the data subject is added, without undue delay and in clear and plain language (Art. 34(1) GDPR); it does not apply, among other cases, where effective encryption is in place or where the high risk no longer exists as a result of subsequent measures (Art. 34(3) GDPR).

Germany/Austria: the 72-hour deadline applies uniformly across the EU (Art. 33(1) GDPR). The only difference is the addressee of the notification — in Germany the competent state data protection authority (§ 40(1) BDSG), and for federal public bodies the Federal Commissioner for Data Protection (BfDI) (§ 9(1) BDSG); in Austria the Data Protection Authority (§ 18(1) DSG).

Every breach is documented, including one that is not notified: the time of occurrence and of becoming aware, a description, the consequences and risk assessment, the measures taken and — where no notification was made — the reasons for that (Art. 33(5) GDPR).

Fix (practical recommendation; the legally decisive deadline is the one in Art. 33(1) GDPR): a personal data breach procedure with a 24-hour internal trigger and notification to the competent supervisory authority within 48 hours.

5. No TIA for US providers

The TIA is maintained for each US provider and records the third country transfer together with the safeguard chosen — as a practical recommendation even under the DPF. The background: recipients in third countries need a safeguard — in practice SCCs, the DPF or BCRs. If the DPF collapses, the risk is immediate.

The documentary place for this is the record of processing activities: Art. 30(1) GDPR requires third country transfers to be stated, including documentation of suitable safeguards, and the same applies to processors under Art. 30(2)(c) GDPR — kept in a column of its own, not as a footnote (for the mandatory fields see point 1). A frequent finding: US tools such as Mailchimp, Google or Zoom appear in the record without any third country reference. Independently of this, the assessment of safeguards under Art. 28(1) GDPR remains — even a DPF-certified provider must provide sufficient guarantees of appropriate technical and organisational measures. Practical recommendation: document this assessment of safeguards for DPF-certified providers as well.

Fix (practical recommendation, scope of review drawn from practice): document a TIA for each US provider and record in it: 1. the provider and the sub-processors used, 2. the categories of data and the groups of data subjects concerned, 3. the destination country and the safeguard chosen (SCCs, DPF or BCRs), 4. supplementary technical measures such as encryption, 5. the outcome and date of the assessment, 6. a fallback safeguard: for providers relying on the DPF, record in advance whether the same transfer could alternatively be based on SCCs and whether the provider already offers SCCs — so that no renegotiation is needed if the DPF basis falls away.

6. No DPO appointed despite the § 38 BDSG threshold

20+ employees engaged in automated processing (Germany, § 38(1) BDSG) → a DPO is mandatory. Statutory fine range: up to EUR 10 million or 2 % of worldwide annual turnover (Art. 83(4) GDPR). Austria has no such headcount threshold: the obligation to appoint follows there directly from Art. 37(1) GDPR (supplemented by § 5 DSG). Irrespective of headcount, a DPO must be appointed in both countries where the core activities involve regular large-scale monitoring or large-scale processing of special categories of data (Art. 37(1)(b), (c) GDPR).

In Germany, one of several conditions is sufficient. § 38(1) sentence 1 BDSG applies where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data. Irrespective of headcount, § 38(1) sentence 2 BDSG applies where processing operations are subject to a data protection impact assessment under Art. 35 GDPR, or where data are processed commercially for the purpose of transfer, of anonymised transfer, or for purposes of market or opinion research. Working students, trainees and marginally employed staff also count, provided they work with personal data.

Germany/Austria: the jurisdictions also diverge on protection against dismissal. In Germany, § 6(4) BDSG applies — dismissal only for cause — to non-public bodies via § 38(2) BDSG, and only where the appointment is mandatory. The CJEU has also held that protection against dismissal applies irrespective of the group structure (C-453/21, X-FAB Dresden, 2023). In Austria, Art. 38(3) GDPR applies directly: the DPO must not be dismissed or penalised for performing their tasks.

Fix (practical recommendation): appoint an external or internal DPO immediately and notify the competent supervisory authority. Document the appointment in writing and add the contact details to the privacy notice.

7. Privacy notice >12 months old

A mandatory update whenever the processing changes. Stale notices are an indicator.

The twelve months in the heading are an indicator drawn from practice. The information obligations under Art. 13 and Art. 14 GDPR are triggered by a change in the processing, not by a calendar interval. Twelve months without any adjustment are merely an indicator that the reconciliation with the record of processing activities has not taken place; hence the half-yearly rhythm in the fix.

The information obligations follow directly from Art. 13 and Art. 14 GDPR. The mandatory items include the reference to the right to lodge a complaint with a supervisory authority (Art. 13(2)(d) GDPR) — in practice it is worth checking this when the registered office, legal form or jurisdiction changes. Where a DPO has been appointed, the DPO appointment checklist provides, as a practical step, for their contact details to be added to the notice.

The second checkpoint is alignment with the record of processing activities. Practical recommendation: reconcile categories of recipients, third country transfers and time limits for erasure between the two documents. Outdated recipient lists — a replaced newsletter tool, for example — and missing erasure periods are among the most frequent RoPA errors and feed straight through into the privacy notice.

Austria: the Austrian Data Protection Authority must be named as the complaints body (Art. 13(2)(d) GDPR), with its address and the complaints route; typical Austrian features also include separate categories of recipients such as the ÖGK instead of the statutory health insurance fund in Germany. The DSG contains no separate provision on the information obligations.

Fix (practical rhythm; no statutory deadline is established here): a half-yearly reconciliation of the privacy notice against the RoPA — categories of recipients, third country transfers, erasure periods, contact details of the controller and the DPO, and the competent supervisory authority as the complaints body. In addition, ad hoc for every new tool, every change of registered office or legal form, and every change of jurisdiction.

8. Applicant data retained >6 months

BAG 2 AZR 1180/16: mandatory deletion 6 months after the rejection. A talent pool only with consent.

Why a retention window is needed at all follows from anti-discrimination law. In Germany, a claim under § 15(1) or (2) AGG must be asserted in writing within two months; in the case of an application, the period begins upon receipt of the rejection (§ 15(4) AGG). If a dispute arises, § 22 AGG applies: a party who proves indicia suggesting discrimination on a ground under § 1 AGG shifts the burden of proof to the other party. Without the selection documents within the relevant window, that counter-evidence cannot be produced — deleting too early is therefore just as much a risk as retaining too long. The two-month period alone does not give rise to a six-month retention window — the six months follow from the BAG decision cited above.

Austria: the deadline is constructed differently. Claims arising from a failure to establish an employment relationship must be asserted in court within six months of the rejection (§ 15 and § 29 GlBG respectively). Where the damage consists solely in the application not being considered, compensation of up to EUR 500 is due (§ 12 and § 26 GlBG respectively).

For the talent pool, consent is the legal basis — with the demonstrability and withdrawal requirements from Art. 7(1) and (3) GDPR (see point 3).

Fix (Germany: implementation of the BAG requirement from 2 AZR 1180/16; the Austrian period is a practical recommendation): an automated deletion rule in the ATS: Germany six months after the rejection; Austria set so that the six-month period for asserting claims in court from the rejection (§ 15 and § 29 GlBG respectively) is fully covered — as a practical recommendation likewise six months from the rejection, with a deletion hold for as long as proceedings are pending. A talent pool only with documented consent in a separate data record.

9. No training in GDPR and AI literacy

Art. 32 GDPR and Art. 4 AI Act from 2 February 2025. Training obligation; annual repetition is a practical rhythm, not a statutory deadline (see the fix).

On the data protection side, training is part of the data protection officer's monitoring task: Art. 39(1)(b) GDPR expressly names awareness-raising and training of staff involved in processing operations.

On the AI side, the AI Act timeline has largely taken effect: the Regulation has applied in general since 2 August 2026, and its Chapters I and II since 2 February 2025; the obligations for high-risk AI systems (Chapter III, Sections 1 to 3) apply, in the version applicable since 27 July 2026, only from 2 December 2027 for systems under Art. 6(2) and Annex III and from 2 August 2028 for systems under Art. 6(1) and Annex I (Art. 113 AI Act as amended by Regulation (EU) 2026/1744). Two topics therefore belong in every training session that covers AI tools: that emotion recognition in the workplace and in education institutions is among the prohibited practices (Art. 5(1) AI Act), and that deployers must disclose where they generate or manipulate deepfakes (Art. 50(4) AI Act), while the machine-readable marking of synthetic audio, image, video or text output is an obligation on providers (Art. 50(2) AI Act).

Fix (practical recommendation — the annual cycle is a practical rhythm, not a statutory deadline established here): an e-learning module with a quiz and proof of participation, repeated annually and additionally on an ad hoc basis for new processing operations and new AI tools. Record in the training plan who takes part — your own staff and service providers with access to the AI tools in use.

10. No procedure for data subject rights

Art. 15-22: a reply within 1 month is mandatory. Where matters are complex, extendable to 3 months.

Put precisely: the controller provides information on the action taken on a request under Art. 15 to 22 without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months where necessary, taking into account the complexity and number of the requests; the data subject must be informed of the extension within the first month, together with the reasons (Art. 12(3) GDPR). The extension therefore does not take effect by itself — it must be notified in time.

The fine range here is the higher one — up to EUR 20 million or 4 % (Art. 83(5) GDPR, for the ranges see point 2). In Germany, § 43(1) BDSG additionally makes two infringements in the consumer credit context (§ 30 BDSG) administrative offences subject to a fine — including the incorrect handling of an access request from a lender in another EU Member State; the range is up to EUR 50,000 (§ 43(2) BDSG).

Austria: the deadlines in Art. 12(3) GDPR apply unchanged. In addition, § 11 DSG provides for a proportionate application of Art. 83 GDPR — in particular a reprimand by the Data Protection Authority instead of a fine for first-time infringements.

Fix (practical recommendation): document the date of receipt of every request (day 0), verify identity, keep a deadline calendar with lead time before day 30; prepare text blocks for access, erasure and rectification as well as a separate template for the extension notice with reasons, to be sent within the first month (Art. 12(3) GDPR). Define a central inbox address so that requests do not sit unattended in individual employees' mailboxes.

Obligations, triggers and references at a glance

The table brings together the provisions on which the ten points and the FAQ rely. In the column 'Deadline / standard', practical recommendations are expressly marked as such; all other entries in that column reproduce the legal act named in each case. A dash appears where the obligation is linked to the trigger occurring and the overview does not state a deadline.