Who does GDPR apply to in 2026?

Many business leaders still believe that the General Data Protection Regulation (GDPR) only targets large companies or the tech giants. It is a misconception. In practice, almost every organisation processes personal data and is therefore covered. Here is a clear overview of who needs to comply in 2026, and to what extent.

What the text says: a very broad scope

GDPR applies as soon as an organisation carries out processing of personal data. Two key notions to remember:

• Personal data is any information relating to an identified or identifiable natural person: name, email address, phone number, IP address, customer ID, vehicle registration number and so on.
• Processing is any operation performed on that data: collection, recording, consultation, storage, sending an email, archiving, erasure…

In other words, keeping a simple customer file in a spreadsheet already counts as processing personal data. The CNIL regularly points this out: there is no headcount or turnover threshold below which you would be exempt from GDPR.

The location criterion: GDPR reaches beyond borders

The Regulation applies to any organisation established in the European Union, but also to any entity, even outside the EU, that targets people in the EU (offering goods or services, monitoring online behaviour). A French company selling online is therefore covered, as is a foreign company addressing the French market.

In practice, does it apply to you?

Ask yourself these simple questions. If you answer ‘yes’ to any of them, you process personal data:

• Do you have employees? (contracts, payroll, access badges, emails)
• Do you have identifiable customers or prospects?
• Do you run a website with a contact form, newsletter or customer account area?
• Do you use invoicing, CRM or accounting tools?
• Do you use service providers that handle your data (hosting provider, SaaS software)?

In the overwhelming majority of cases, the answer is yes. A three-person micro-business that sends out quotes and pays its staff is already fully covered.

Controller or processor?

GDPR distinguishes between two roles, and it is essential to know which one you hold: you often hold both.

The controller

This is the organisation that determines the purposes and means of processing. Example: you decide to build a prospect file for your sales prospecting. You are the controller of that processing.

The processor

This is the organisation that processes data on behalf of a controller. Example: a SaaS software publisher that hosts its users’ customer files acts as a processor. Article 28 GDPR governs this relationship through a precise contract.

In practice, an SME is almost always the controller for its own files (customers, HR) and can be a processor when it handles its own clients’ data.

The obligations that apply to everyone

Whatever your size, some basic obligations apply:

1. List your processing activities in a record (see below for the relief granted to smaller organisations).
2. Inform the people whose data you collect (clear privacy notices).
3. Base each processing activity on a lawful basis (consent, contract, legal obligation, legitimate interest…).
4. Respect people’s rights: access, rectification, erasure, objection, portability.
5. Secure the data with appropriate technical and organisational measures.
6. Notify personal data breaches to the CNIL within 72 hours where the risk warrants it.

Relief for organisations with fewer than 250 people

An important nuance: organisations with fewer than 250 people benefit from a partial exemption from the record. They only have to include processing that is not occasional, that is likely to result in a risk to people’s rights, or that involves sensitive data. In practice, this exemption is so narrow that almost every business is better off keeping a full record: it is in any case the best tool for managing compliance.

Do you need to designate a DPO?

Designating a Data Protection Officer (DPO) is mandatory in three cases:

• you are a public authority or body;
• your core activities involve regular and systematic monitoring of people on a large scale;
• your core activities consist of large-scale processing of sensitive data (health, opinions, biometrics…).

Outside these cases, designation is optional but recommended by the CNIL. A DPO, in-house or external, centralises the management of your compliance and becomes your contact point with the authority. But DPO or not, keeping your records remains your organisation’s responsibility: the CNIL states that it cannot be delegated. Management software lets you take this on without being a legal expert, with outside expertise providing support when a topic calls for it.

What you risk if you fail to comply

GDPR provides for fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Beyond fines, non-compliance exposes you to reputational risk and a growing commercial risk: more and more B2B clients demand proof of compliance before signing a contract.

Compliance is not just a regulatory constraint: it has become a matter of trust with your clients and partners.

Where to start?

If you find that GDPR applies to you (which is almost certain), the way forward is simple:

1. Map your processing activities (what data, for what purpose, where is it?).
2. Write your records and your privacy notices.
3. Check your lawful bases and your retention periods.
4. Secure access to data and formalise your procedures.
5. Designate a lead contact or a DPO to keep everything up to date over time.

This is exactly what DPO Connect lets you manage: the tool turns these steps into a clear roadmap (where you stand, what is left, the proof attached to each requirement), and our team can take on all or part of the work, as an option.

Reference sources: Regulation (EU) 2016/679 (GDPR), Articles 4, 28, 30, 37; CNIL recommendations (cnil.fr).