What It Actually Means
Its core demand is simpler than the industry around it suggests. Know what personal data you hold, have a lawful reason for holding it, keep it only as long as you need it, protect it sensibly, and be able to answer for all of that when asked.
Most of the complexity people encounter is not the regulation. It is products being sold against fear of it.
What It Genuinely Requires
For a typical owner-managed business, the real obligations are these.
Know what you hold and why. A written record of what personal data exists, where it lives, why you have it and how long you keep it. Unglamorous, and it is the foundation everything else rests on, because you cannot protect or delete what you have not catalogued.
Have a lawful basis. Consent is one of six and frequently the weakest choice, because consent can be withdrawn. Contract and legitimate interests cover most ordinary business activity more robustly.
Be able to respond to a request. Someone can ask what you hold about them, ask for it to be corrected, or in some circumstances ask for it to be deleted. You have a month. The practical difficulty is almost never the legal test, it is finding every copy across a CRM, an inbox, a spreadsheet and three years of email.
Report serious breaches within 72 hours. To the ICO, and to affected individuals where the risk to them is high.
Protect the data proportionately. The standard is appropriate rather than absolute, and it scales with sensitivity.
What Is Oversold
Cookie banners are the most visible example. They are required for non-essential cookies and they are also the smallest part of compliance, while receiving most of the attention because they are the part everyone can see.
Certification is another. There is no official GDPR certificate that makes you compliant. Products claiming to make you GDPR-compliant are selling a component of it at most, usually documentation.
Deleting everything is a third. Retention means keeping data no longer than necessary for the stated purpose, and there are perfectly legitimate reasons to keep records for years, including tax and legal obligations.
What To Ask
- Where does personal data live in this system, and who can see it? Any supplier building for you should be able to answer without hesitating.
- What happens when someone asks to be deleted? If the answer requires a developer every time, that is a design problem that will recur.
- What is logged, and for how long? Logs are personal data too, and they are the thing everyone forgets.
- If this supplier disappeared, could we still meet a request about data they hold?
Where It Meets The Build
The parts that matter in software are ordinary engineering rather than legal work: access control so people see only what their role requires, an audit trail so you can show who did what, encryption for data in transit and at rest, deletion that genuinely removes records rather than hiding them, and export that can answer a subject access request without a developer.
Building those in from the start costs very little. Retrofitting them into a system that spreads personal data across a dozen tables and three integrations is where the expense arrives, which is the real reason to raise it before the build rather than after.
This is a plain-language summary rather than legal advice. Where the stakes are high, take proper advice.
More terms are in the glossary.
