Does GDPR apply to my company?
Yes, in virtually all cases it does. The General Data Protection Regulation has no threshold for turnover, staff or sector. As soon as your company processes personal data, such as names, email addresses or payroll information, the regulation applies to that processing. This applies to a sole trader with one customer just as much as to an installation company with fifty employees.
The difference with regulations such as NIS2, CSRD or VSME standards is that these do work with thresholds for company size or sector. GDPR works differently: it is not the size of your company that is decisive, but the question of whether personal data is being processed and how. Because of this, GDPR in practice affects virtually every company, even though that does not always feel like it.
What the regulation means by personal data
GDPR defines personal data as any information relating to an identified or identifiable natural person. This is broader than many entrepreneurs think. A customer address list, a personnel file, a job application letter still in your mailbox, or camera footage at the entrance: it all falls under it. Even a freelancer who only sends invoices with name and address is already processing personal data.
The regulation distinguishes between the controller, who determines why and how data is processed, and the processor, who does so on behalf of another. For example, a payroll administration office is a processor for your employees' payroll data, while you yourself are the controller. Which role applies to your company and what obligations come with it is something that varies from situation to situation and on which the supervisory authority and a lawyer can provide guidance.
Why this subject comes up in your customer's questionnaire
Clients are increasingly asking their suppliers not only about sustainability or cybersecurity, but also about the handling of personal data. This happens, for example, when you process data of your customer's employees or end customers on their behalf, or when you have access to systems containing such data. In that case, the customer wants to know whether there is a processor agreement in place, whether a record of processing is kept, and how a data breach is reported.
These questions often overlap with the cybersecurity questionnaire, because information security and data protection are closely linked in practice. A company that supplies software or administrative services to customers is more likely to encounter these questions than an installation company that mainly does physical work. If you encounter this type of question repeatedly in different formats from different customers, you can consult the knowledge base by topic to read what the background of such a question is and where the official text can be found.
What this means in practice
Whether GDPR specifically imposes obligations such as a data protection officer, a processor agreement or a processing register depends on the nature and scope of processing within your company. This is not a question that can be answered in general terms; the regulation itself and the guidelines of the national supervisory authority provide the criteria for this. For most SMEs, the starting point is simple: map out which personal data is processed, by whom, and for what purpose.
This overview is also useful when a customer asks about it. Store documents such as a processor agreement or a privacy statement in a fixed location, so that you do not have to search for them each time. How this works within one supply chain file and how the data contained in it is secured, you can read on the page about how data and privacy are protected.
Would you like to first see which questionnaires and topics are relevant for your company, including whether data protection plays a role? Take the free check in a few questions for an initial indication, or read in the answers to frequently asked questions how other entrepreneurs approach this. For your own situation, it is advisable to consult the competent supervisor or a lawyer if in doubt.