Does the GDPR apply to my business if I have no employees?
The General Data Protection Regulation makes no distinction based on company size. There is nowhere in the law a threshold for number of employees or turnover below which the rules do not apply. What matters is one question: do you process personal data? As soon as you record a customer name, an email address, an address for an invoice or data from an applicant, you are engaged in processing within the meaning of the GDPR, even if you are the only employee of your business.
In practice, this means that virtually every business, from sole trader to large enterprise, falls somewhere within the scope of the GDPR. The difference is not whether or not the law applies, but in the scope and nature of what you process: a freelancer who invoices three clients a year faces a different practical challenge than a webshop with thousands of customer profiles. The obligations become heavier as the processing becomes riskier or more extensive, but the starting point remains the same for everyone.
What actually determines how heavily the GDPR weighs on you
The GDPR has one concrete exception that relates to business size: the obligation to maintain a processing activity register generally does not apply to organisations with fewer than 250 employees, unless the processing is not occasional, poses a risk to the rights of data subjects, or concerns special categories of personal data such as health data. In practice, most SMEs still fall under one of those exceptions, simply because customer data is processed on an ongoing basis and is therefore not occasional. So the exception is narrower than it appears at first glance.
More important than that one exception is the nature of what you process. If you only process business contact details of other businesses, the risk is usually limited. If you process data of consumers, employees, applicants or camera footage, then the same obligations apply as for a large company: a legal basis for the processing, clarity towards data subjects, agreements with parties that process data on your behalf, and a plan for if something goes wrong.
Situations in which the GDPR clearly applies to you
If you have a webshop, you process customer data, order data and often data via a payment provider or delivery service. If you have employees, you process salary data, absence data and sometimes a citizen identification number. If you work with applicants, you process CVs and cover letters. If you use camera surveillance at a location, you process image material of visitors and employees. In all these cases, the GDPR clearly applies, regardless of whether you work alone or with ten people.
Situations in which it carries less weight, but does not disappear
A freelancer who exclusively invoices business clients and has no employees or consumers processes usually less sensitive data and in smaller volumes. That makes the practical task more manageable, but it does not mean that the law does not apply. Even then you must be able to explain why you retain data, how long, and with whom you might share it, for example via an accounting package or a cloud service. The EDPB guidelines and the explanations of the Dutch Data Protection Authority consistently emphasise that the obligations move with the risk, not that they disappear for small parties.
How you check this for your own situation
The most useful question is not "am I big enough to count", but "what personal data do I process, from whom, and why". Go through your main business processes: invoicing, customer contact, personnel administration, marketing, security. In every process where a name, email address or other identifiable information appears, the GDPR is relevant. Anyone who does not yet have a clear overview of this will find in the knowledge base with explanations for different situations a starting point to determine which obligations apply to which type of processing.
The most frequently asked questions from other entrepreneurs also provide a good picture of where doubts usually lie; these are collected on the page with answers to questions that SME entrepreneurs often askIf you want to know how the information on gdpria.eu is created and which source belongs to which answer, you can read that on the page that explains where the information used comes from.
The final assessment of your own situation is up to you, possibly with a lawyer or with the Autoriteit Persoonsgegevens as a point of reference for general guidance. What we offer on these pages is structure to enable that assessment, not the advice itself.
If you want to quickly and without obligation see which obligations apply to your type of business, you can create a business account and build up the overview for your own situation. The initial exploration, including the source of each answer, is and remains free.