Why most GDPR checklists don't help the people who actually manage IT

If you've ever searched for a GDPR compliance checklist, you've probably landed on a document full of legal terminology: lawful basis assessments, data protection impact analyses, Article 30 records. Useful for your legal counsel, but not particularly actionable if you're the founder, HR manager, or office manager who's somehow become responsible for making sure laptops are encrypted and ex-employees can't still log in.

This article is the other checklist: the IT side of GDPR compliance. It covers the technical and operational controls your business needs to have in place, explained in plain language, with practical steps you can follow even without a dedicated IT department. We'll walk through IT compliance fundamentals, the gaps that trip SMBs up most often, and how to close them before they become expensive problems.

The stakes are real. As of September 2024, non-compliance with general data processing principles is the single most penalized GDPR violation category, having led to over €2.4 billion worth of fines since enforcement began in 2018 (Statista / GDPR Enforcement Tracker). And these penalties aren't reserved for big tech. There is no SME exemption under GDPR: supervisory authorities regularly issue five and six-figure fines to small and medium-sized businesses for consent failures, data breach mishandling, and inadequate vendor contracts (Secure Privacy).

What GDPR actually requires from your IT systems

GDPR talks about "appropriate technical and organisational measures" (often shortened to TOMs). That phrase sounds vague, but it translates into a specific set of IT controls. Here's how each core requirement maps to something you can actually act on.

• Encryption: Every device that touches company data (laptops, phones, tablets) must have full-disk encryption enabled. This means FileVault on macOS, BitLocker on Windows, or equivalent mobile encryption. If a device is lost or stolen, encryption is what determines whether you have a reportable breach or just a missing laptop.
• Access control and least-privilege permissions: Employees should only have access to the data and systems they need for their role. Approximately 87% of organizations have sensitive data accessible to every employee, which directly violates the least-privilege principle required under GDPR (Varonis).
• Data retention and deletion: You need clear policies on how long you keep personal data and a process to delete it when it's no longer needed. This includes employee data, customer records, and anything stored in cloud tools.
• Audit logging: You need to be able to show who accessed what, when, and from where. This is essential for incident investigations, audit preparation, and responding to data subject requests. Keeping proper IT documentation is the foundation for audit readiness.
• Vendor data processing agreements (DPAs): Every cloud tool or SaaS vendor that processes personal data on your behalf needs a signed DPA. If you're using Google Workspace, Slack, HubSpot, or any similar tool, you need one in place with each provider.
• Incident response: GDPR requires you to report certain breaches to your supervisory authority within 72 hours. You need a documented process for detecting, assessing, and reporting incidents, even if it's a one-page plan.

The important distinction: your legal team handles consent forms, privacy policies, and data subject requests. Your IT side handles the controls above. If you're wearing both hats, focus on the IT controls first, because they're the ones that prevent incidents from happening in the first place.

Where SMBs get caught: the gaps auditors and clients spot first

Most SMBs don't fail a compliance check because of some obscure legal misstep. They fail because of basic IT hygiene gaps that are surprisingly common and easy to fix once you know where to look.

Stale accounts and ghost users. On average, companies have approximately 1,800 user accounts with passwords that never expire and around 15,000 inactive "ghost" user accounts that remain enabled. These are accounts belonging to former employees, contractors, or interns whose access was never properly revoked. Each one is a potential entry point for unauthorized access.

The consequences are not hypothetical. In May 2024, a former FinWise Bank employee accessed internal systems after their employment had ended, exposing personal information belonging to 689,000 customers (Syteca). In 2022, a former Cash App employee whose access had not been properly revoked downloaded internal reports and exposed the personal data of approximately 8.2 million U.S. customers (Teramind).

Unencrypted devices. One of the first GDPR enforcement actions targeted a small hospital group in Portugal, which was fined €400,000 specifically for not having adequate access controls in place: not for a data breach, but for a missing IT control (ComplianceJunction). If your laptops aren't encrypted and you can't prove it, you have a problem even before anything goes wrong.

Missing vendor DPAs. Many SMBs adopt SaaS tools quickly, especially during growth phases, without ever checking whether a DPA is in place. B2B clients conducting vendor due diligence will ask for proof of these agreements, and not having them can stall or kill a deal.

These gaps feel small individually. Together, they paint a picture of an organization that hasn't taken cybersecurity fundamentals seriously, and that's exactly what regulators and enterprise clients are looking for.

How to implement GDPR IT controls without an IT team

Knowing what's required is one thing. Implementing it when you don't have IT staff is another. Here's how to tackle each control area practically.

Device encryption and access control from day one

Encryption needs to be enforced, not requested. Sending employees a Confluence page titled "Please enable FileVault" is not a control. It's a suggestion. To actually meet GDPR's technical measures requirement, you need a way to push encryption policies to devices and verify compliance centrally.

For access control, start by mapping which roles need access to which systems. A marketing intern doesn't need access to your finance tools. A sales rep doesn't need admin rights to your HR platform. The principle of least privilege sounds academic, but in practice it means: give people the minimum access they need, review it periodically, and remove it when their role changes.

The challenge for SMBs is that doing this manually, through spreadsheets and calendar reminders, works until you hit about 15 to 20 employees. After that, things get missed. That's why 41% of SMBs cite a lack of in-house IT resources as a top operational challenge, making it harder to implement and enforce technical compliance controls such as device encryption and access management (Global Growth Insights).

If you're building your IT security without a dedicated team, the key is to use tooling that enforces policies automatically rather than relying on manual checks.

Secure offboarding: revoking access and wiping devices when someone leaves

Offboarding is where most SMBs have the widest compliance gap. When an employee leaves, you need to revoke all account access (email, cloud apps, internal tools), recover or remotely wipe company devices, and transfer ownership of shared files and resources. All of this needs to happen on or before their last day.

In practice, many companies handle offboarding through a Slack message to the office manager and a hope that someone remembers all the tools. This is how ghost accounts accumulate. A proper offboarding process follows a structured checklist. Understanding what happens when a company device is lost or stolen is part of the same discipline: you need remote wipe capabilities and documented procedures before the incident occurs.

If you're onboarding people into legal or compliance roles, the same principle applies in reverse: onboarding checklists for compliance-adjacent roles should define exactly which systems they get access to and under what conditions.

Building audit logs you can actually show to a client or auditor

GDPR doesn't explicitly require audit logs, but the "accountability principle" (Article 5(2)) means you need to demonstrate compliance, not just claim it. When a B2B client asks "How do you control access to personal data?" you need to show evidence, not describe a process from memory.

Centralised logging means collecting records of user access, permission changes, device compliance status, and security events in one place. Spreadsheets and shared drives don't count as audit-ready evidence because they're editable, unversioned, and easy to lose. You need logs that are tamper-resistant, timestamped, and searchable.

The same discipline applies if you're dealing with AI tools like ChatGPT on company devices: you need visibility into what's being used, by whom, and whether data is flowing to third-party services without a DPA.

Automating compliance processes to reduce risk

The pattern across every section above is the same: manual processes work at small scale, then break exactly when the stakes get higher. Automation doesn't mean replacing judgment. It means removing the human-error gaps that cause most compliance failures.

Consider what happens with access reviews. GDPR expects you to periodically verify that access permissions are still appropriate. In a company with 50 employees and 15 SaaS tools, that's 750 permission relationships to check. Doing this quarterly by hand is a full day of work, assuming you don't miss anything.

Automated enforcement closes these gaps at three levels. First, policy enforcement: encryption, password requirements, and screen-lock timeouts are pushed to devices automatically, so compliance isn't optional. Second, lifecycle management: when an employee is marked as leaving in your HR system, their accounts are revoked and devices are wiped without someone needing to remember each step. Third, continuous monitoring: instead of periodic manual reviews, tools can flag non-compliant devices or excessive permissions in real time.

Across a benchmark of more than 200 deeploi customers using an integrated IT management platform, IT workload dropped by up to 90% through automation of tasks like hardware provisioning, software installation, account creation, and security configuration. That kind of reduction is what makes compliance sustainable for teams that don't have a dedicated IT function.

Which tools support IT compliance for SMBs?

There are three broad approaches, and each has clear trade-offs.

Manual checklists and spreadsheets. Cost: nearly free. Effectiveness: limited. You can build a spreadsheet that tracks who has access to what, when devices were last checked, and which DPAs are signed. The problem is that nothing is enforced. A spreadsheet can say "encryption required" without any mechanism to verify it's actually on. For teams under 10 people, this might suffice temporarily, but it creates documentation debt that compounds quickly.

GRC platforms (Vanta, Drata, Sprinto). These tools are strong at evidence collection, policy documentation, and audit preparation. They connect to your cloud infrastructure and pull compliance evidence automatically. If you're preparing for ISO 27001 certification, they're valuable. However, GRC platforms generally monitor and report. They don't enforce technical controls themselves. They'll tell you that a laptop isn't encrypted, but they won't encrypt it for you.

Integrated IT management platforms. This is the category that combines enforcement with compliance visibility. Tools in this space push encryption policies to devices, manage user accounts and permissions centrally, automate onboarding and offboarding workflows, and generate audit logs as a byproduct of normal operations. deeploi operates in this category, and customer outcomes give a sense of the scale of automation possible: among deeploi customers, The Female Company recorded 97% time savings and a 62% reduction in IT costs, while HOLY Energy brought full employee onboarding down to 5 minutes.

The right choice depends on your situation. If you already have an IT team and need to prepare for a formal audit, a GRC platform makes sense. If you're an SMB without IT staff and need the controls themselves, not just evidence of controls, an integrated platform that enforces compliance at the device and account level is the more practical starting point.

What to look for in a compliance tool as a growing company

When evaluating any tool for IT compliance, these criteria matter most at SMB scale.

1. Automation depth. Does the tool enforce policies (encryption, access control, offboarding), or does it only monitor and report? Monitoring without enforcement creates work; enforcement reduces it.
2. Audit log coverage. Can you export timestamped, tamper-resistant logs of access changes, device compliance, and security events? Will those logs hold up when a client or auditor asks for evidence?
3. Ease of use for non-IT staff. If the person running compliance is also handling HR, office management, or finance, the tool needs to be usable without deep technical knowledge. Complex admin consoles that require IT training defeat the purpose.
4. Integration with your existing stack. The tool should connect to your identity provider (Google Workspace, Microsoft 365), your HR system, and your device fleet. If it requires you to maintain a separate system of record, you'll end up with data drift and blind spots.
5. Cost at SMB scale. Enterprise GRC platforms often price per employee per month at rates that make sense at 500 employees but feel steep at 30. Look for pricing that scales with your actual team size.

Just 28% of SMBs identified cybersecurity as an area they worry about negatively impacting their business (GTIA). That gap puts smaller companies at disproportionate risk, which means the bar for getting started is actually low. Even basic automated controls put you ahead of the majority.

Frequently asked questions

Do SMBs really get fined for GDPR violations?

Yes, and the trend is accelerating. 2024 saw over €1.2 billion in GDPR fines issued across the EU, with enforcement scope broadening beyond big tech into financial services and energy sectors (CyberPilot). GDPR fines operate on two tiers: up to €10 million or 2% of annual turnover for procedural failures, and up to €20 million or 4% of annual turnover for substantive violations such as unlawful data processing. Yet 96% of SME owners do not know the maximum fine for breaching GDPR as a percentage of global turnover (CPO Magazine). The misconception that enforcement only targets large enterprises is one of the most dangerous assumptions an SMB can make.

How is GDPR IT compliance different from ISO 27001?

GDPR is a regulation with legal penalties. ISO 27001 is a voluntary certification standard. They overlap significantly on technical controls (encryption, access management, incident response), but GDPR also includes specific requirements around personal data rights, breach notification timelines, and data processing agreements that ISO 27001 doesn't cover directly. Many SMBs use ISO 27001 as a framework to satisfy GDPR's technical requirements, which is a valid approach, but ISO 27001 certification alone doesn't equal GDPR compliance.

How do I prove GDPR compliance to B2B clients asking for it?

Most enterprise clients will ask for three things: a list of your technical and organisational measures (TOMs), signed DPAs with your sub-processors (cloud tools), and evidence of access control (who can access what data, and how you manage permission changes). Having centralised audit logs, documented device policies, and automated offboarding processes gives you concrete evidence to share, rather than relying on verbal assurances.

What's the fastest way to become GDPR-compliant on the IT side without hiring anyone?

Start with the checklist in this article: enable encryption on all devices, implement least-privilege access, sign DPAs with your cloud vendors, document your incident response process, and build a proper offboarding workflow. For ongoing enforcement and audit readiness, consider a managed IT platform like deeploi that enforces encryption, access control, and offboarding automatically at the device level, so compliance isn't dependent on someone remembering to check a spreadsheet.

Conclusion

GDPR compliance isn't a legal checkbox you hand off to a lawyer and forget about. The technical controls, encryption, access management, offboarding, audit logging, are IT operations problems. They need to be built into how your company runs every day, not bolted on before an audit.

The good news is that the bar for basic compliance is achievable, even without an IT department. Start with the controls outlined in this checklist, prioritize the gaps that create the most risk (stale accounts and unencrypted devices are almost always at the top), and invest in tooling that enforces policies rather than just tracking them.

If you're unsure which controls are already missing in your current setup, the practical next step is to audit your device fleet and access permissions against the checklist above, and explore platforms like deeploi that can close the most common gaps automatically.