GDPR Without the Headache
A no-nonsense guide for business owners who'd rather be doing literally anything else.
The five-word law in plain English. What GDPR really requires, who it applies to (spoiler: probably you), what it costs to get wrong, and how to get it right without hiring a privacy lawyer.
Free account required — no credit card, no upsell, no spam.
The Setup
"The General Data Protection Regulation." Five words that make every small business owner's eyes glaze over.
Most owners assume GDPR is either someone else's problem or a giant compliance project they'll get to "eventually." Both assumptions are expensive. Over €7.1 billion in fines have been issued since 2018 — and most of the ones aimed at small businesses are for the same simple mistake.
You don't need a privacy lawyer. You need the basics, done properly.
The Privacy Manual Your Accountant Never Wrote.
You started a business. Somewhere along the way, the EU passed a 99-article regulation that suddenly applied to you, your website, your newsletter and your cookie banner. Nobody handed you a translation.
GDPR Without the Headache is 23 pages of plain-English answers — what it is, who it applies to, what you actually need to do, and what it costs when you get it wrong.
No jargon. No fear-mongering. Just the stuff you should've been told before someone made you tick the box.
What's Inside
12 chapters. Each one a question you've quietly been avoiding.
What Even Is GDPR?
The five-word law in plain English: collect with a reason, be honest, keep it safe, delete when done.
Does This Apply to Me?
Almost certainly yes. Why GDPR follows your customers — not your office address.
The Six Magic Words (Lawful Bases)
Consent, contract, legal obligation, vital interests, public task, legitimate interests. Pick at least one, before you collect.
What People Can Ask You to Do
The eight rights — access, erasure, rectification, portability and more. You have 30 calendar days to respond.
What You Actually Need to Do
A practical 8-step checklist: data mapping, privacy policy, consent, security, processor contracts, request handling.
When Things Go Wrong (Breach Protocol)
The 72-hour rule, what to report, when to tell affected people, and the full breach response checklist.
Who's Watching (The Regulators)
How EU/EEA Data Protection Authorities work, the one-stop-shop mechanism, and which DPA applies to you.
The Price of Getting It Wrong
Real fines on real small businesses — most of them for the same easily-avoided mistake: contacting people without consent.
"But I'm Not in the EU"
For US, UK, Australian, Canadian owners: extraterritorial reach, EU Representatives, and why non-compliance makes you a liability.
The Costs of Compliance
Realistic numbers — €5k–€50k typical setup, plus the ongoing security obligations GDPR quietly requires.
Your GDPR Action Plan
This week, this month, this quarter — a short, sortable checklist you can actually start on Monday morning.
Common Myths That'll Get You in Trouble
"We're too small." "We don't collect personal data." "A cookie banner is enough." All wrong — here's why.
For Owners Who Just Want a Straight Answer.
You're not a lawyer. You're not a Data Protection Officer. You're a business owner trying to run a business. Someone bolted a cookie banner onto your site three years ago and you've crossed your fingers ever since.
This guide is written the same way you'd ask a friend who actually understands this stuff: short sentences, real examples, no Latin. By the end you'll know exactly what to do, in what order, and what to stop worrying about.
Real Fines, Real Small Businesses.
- €200,000 — unsolicited text messages without consent.
- €160,000 — a furniture company making unsolicited calls.
- €140,000 — a marketing firm reselling personal data.
- €80,000 — a home security company cold-calling a purchased list.
- €60,000 — an insurer sending marketing emails without consent.
Notice the pattern? Almost every small-business fine is for the same thing: contacting people without proper consent. It's the easiest violation to avoid.
Lower-tier fines reach €10M or 2% of turnover. Upper-tier: €20M or 4%. They apply to companies of all sizes.
What If…
"I'm not in the EU — does this even apply to me?"
Chapter 9. Short answer: probably yes. If you sell to, serve, or track anyone in the EU/EEA, GDPR follows you. There's also a UK GDPR for UK customers.
"We already have a cookie banner. Aren't we done?"
A cookie banner is about 5% of compliance — the most visible part, but nowhere near the whole picture. Chapter 5 walks through the other 95% in plain English.
"What if we have a breach?"
Chapter 6 is the breach protocol: contain, assess, report within 72 hours, notify affected people if the risk is high, and document everything. There's a checklist you can lift straight off the page.
Free. Because Compliance Shouldn't Need a Consultant on Day One.
No drip sequence. No upsell on page three. Just 23 pages of useful answers that could save your business from a very expensive bad week.
The keeping-data-safe part is where itbit.cc can help you out — if your site runs on WordPress. Our free scanner tells you exactly where you stand.