GDPR for Irish SMEs without the binder

For a lot of Irish SMEs, "GDPR" is a word that arrives with a compliance consultant and a binder nobody reads. That is the wrong frame. GDPR is mostly a set of sensible engineering defaults — and if your software is built well, you are already most of the way there.

The five things that actually matter

You do not need to memorise the regulation. You need to be able to answer five questions about every piece of personal data you hold:

1. Why do we have it? (lawful basis)
2. Do we only collect what we need? (data minimisation)
3. Who can see it, and is that enforced? (access control)
4. How long do we keep it? (retention)
5. What happens if someone asks for it — or asks us to delete it? (subject rights)

If your answer to any of these is "I'm not sure", that is the gap to close — not the paperwork.

Build it in, don't bolt it on

The expensive way to do GDPR is to ship a system and then retrofit compliance. The cheap way is to make a few decisions up front:

• Minimise at the form. Every optional field you remove is a field you never have to protect, justify or delete.
• Encrypt in transit. HTTPS everywhere is table stakes; there is no excuse in 2026.
• Gate access by role. A staff login and an admin login should not see the same data. Enforce it in code, not in a policy document.
• Make deletion a feature, not a fire drill. If "delete this customer" is a button, a subject-access request is a five-minute job instead of a panic.

Breaches are a process, not a catastrophe

The regulation does not punish you for having an incident; it punishes you for handling one badly. Know in advance who you would tell, how fast (72 hours to the DPC for qualifying breaches), and how you would contain it. A platform with server-side session revocation can kill compromised access immediately — which turns a breach into an inconvenience.

The honest bit

Certification (ISO 27001, Cyber Essentials) is valuable but it is a destination, not a prerequisite. What a buyer — or a regulator — actually wants to see first is that you understand your data and have defensible controls. Get the engineering right and the paperwork follows easily.