Term · Data, privacy & security
GDPR (AVG)
The GDPR is the privacy law of the European Union. It applies to every business that uses data about people, including SMEs.
In short
The GDPR (General Data Protection Regulation, in Dutch the AVG or Algemene verordening gegevensbescherming) is the European law on personal data. It has applied since 25 May 2018 to everyone who processes data about people, including small businesses. The law says what you may do with that data and what rights people have.
What is the GDPR?
The GDPR is the European law that governs how you handle personal data. Personal data is any data about a person who can be identified, such as a name, an email address or a customer number.
In Dutch it is called the AVG, short for Algemene verordening gegevensbescherming. In English it is the GDPR. The law has applied throughout the EU since 25 May 2018. In the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises it.
How does the GDPR work?
The GDPR sets out a few basic rules:
- A purpose and a legal basis. You only collect data for a clear purpose. And you have a reason that the law recognises, such as a contract with the customer.
- As little as possible. You do not use more data than necessary, and do not keep it longer than necessary.
- Well secured. You protect the data, for example with two-factor authentication and a good backup.
- Being able to show it. You must be able to demonstrate that you comply with the rules.
People also have rights. For example, they may view their data, have it corrected and in many cases have it deleted.
Example in an SME
Example
Suppose you run an installation company. Customer data is in your CRM and in your accounts, and you want to have those two integrated. Then you look at which data passes through the integration and who can access it. Can the builder of the integration access the data? Then you sign a data processing agreement with that builder.
What does the GDPR mean for your business?
- Know which personal data you have and where it is stored: in your email, your CRM, your accounts or separate Excel lists.
- Does another party work with that data for you, such as a software supplier or a hosting provider? Then you need a data processing agreement.
- Do you put customer data into an AI tool? The GDPR applies then too. Read Is ChatGPT safe for businesses?
- Does something go wrong, such as an email with customer data sent to the wrong person? Then it may be a data breach.
- Does a new processing activity pose a high risk to people? Then you first carry out a DPIA.
For each assignment, you and I sign a data processing agreement. Read more about how I work.
Frequently asked questions
Does the GDPR also apply to a small business?
Yes. The GDPR applies to everyone who processes personal data, large or small. A freelancer with a customer list also falls under it.
Is business data also personal data?
Data about a company itself is not. The name and email address of your contact person are. And with a small business, company data can say something about the owner. Then it also counts as personal data.
What is the difference between the AVG and the GDPR?
There is no difference. GDPR (General Data Protection Regulation) is the English name of the same law.
This is an explanation in plain language, not legal advice.
Sources: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): The GDPR in brief (in Dutch) and Autoriteit Persoonsgegevens: What is personal data? (in Dutch) Consulted on 7 October 2026.
Written by Bart van Engelenhoven Founder of Uniekaiconsultancy in Ede, the Netherlands. Bart analyses how SMEs work and builds software, integrations and AI applications himself. Last updated: 7 October 2026
Read more
Term
Data processing agreement
You sign a data processing agreement with a party that processes personal data for you. When is it mandatory and what does it contain?
Read moreTerm
Data breach (datalek)
A data breach is unintended access to personal data, or its loss. What do you do then, and when do you report it to the Dutch Data Protection Authority?
Read moreTerm
DPIA (data protection impact assessment)
A DPIA maps the privacy risks of a processing activity in advance. When is it mandatory, what goes in it and what does that mean for AI?
Read moreNext step
Curious what could work for you?
- The first conversation is free and without obligation
- By phone or at your premises
- You speak directly with me
Bart van Engelenhoven You tell me what takes up your time, I tell you honestly whether I can help.