Does the GDPR apply to your business?
The General Data Protection Regulation (GDPR) applies to virtually every business that processes personal data, regardless of the size of the business. As soon as you record, store, or use data from customers, employees, applicants, or website visitors, you are dealing with the GDPR. There is no general exemption for small businesses or sole proprietorships.
What does differ is how much is required of you. A webshop that processes customer data, payment data, and newsletter addresses has different obligations than an installation business that only maintains personnel records. So the question is less "does it apply to me" and more "which part of it affects me, and how significant is it".
When you almost certainly have to deal with it
There are a few situations that occur in almost every business and almost always fall under the GDPR. Think of a customer file with name and contact information, a personnel file with salary and absence data, a recruitment process where you receive CVs, a contact form or newsletter on your website, and camera surveillance on the work floor or in the shop. In all these cases, you are processing personal data, and that is exactly what the GDPR is about.
Even if you share that data with another business, for example a bookkeeper, a shipping partner, or a marketing agency, you remain responsible for how it happens. That applies regardless of whether you store the data yourself or have it stored by a service provider.
When it is less clear
There are also situations where it is less straightforward. A purely business relationship between two businesses, where you only exchange business names, Chamber of Commerce numbers, and general contact information of an organization, falls differently under the GDPR than when you record the name of a specific contact person. As soon as information is traceable to an individual, even within a business context, there is a good chance that it is personal data. Exactly where the line is in your situation is something a lawyer or the Data Protection Authority can determine; this article only gives you the direction, not a definitive answer for your specific case.
This kind of borderline case often comes together with other obligations. A webshop that delivers to multiple EU countries may simultaneously have to deal with product safety, packaging, and accessibility alongside the GDPR. see which platforms there are provides an overview of the areas where this can apply, so you don't have to figure out where you stand again for each obligation.
What the size of your business does and does not change
The size of your business changes nothing about whether the GDPR applies, but it does affect a number of concrete obligations. For example, whether you need to appoint a data protection officer, or how detailed a processing register needs to be, depends on the nature and scope of data processing. A business that processes sensitive data on a large scale, such as health data, faces different requirements than a business that only records basic customer data for invoicing. The precise limits and definitions can be found in the official text of the GDPR and in the guidelines of the Data Protection Authority; these are the place to refer to if you want to determine this for your own business.
How to figure this out for your own company
A practical way to start is to make a list of where personal data enters your business: the website, personnel administration, customer service, any cameras, and external parties with whom you share data. For each of those places, you can determine which data it is exactly and why you retain it. That inventory is also the basis for a processing register, and it is work that you ultimately need to do yourself or with a lawyer; no platform can make that substantive assessment for you.
What reglia does in this regard is maintain your business and product data in one place, so you don't have to enter it again at each compliance platform once you determine that an obligation applies to you. How that works exactly and what does and does not happen to your data is explained at the page about how reglia worksQuestions about daily practice, such as what happens when data is shared between platforms, are collected at the frequently asked questions page.
Once you have determined which obligations apply to your business, you probably also want to know how your data is protected in this context. That is described at the page about security and privacy.
Further reading
The GDPR is one of the regulations an enterprise may have to deal with, alongside for example product safety, packaging or accessibility. Curious which platforms are available and which part of your obligations they cover? See which solutions are available and which fits your situation.