Data governance and GDPR: the Belgian SME guide

The GDPR sets the obligations, data governance makes them workable day to day. In concrete terms: the regulation requires you to know which personal data you hold, why, where it sits and who can access it. Governance is the lightweight organization that answers those questions continuously, without turning your SME into a bureaucracy. One without the other does not hold up: GDPR on paper protects nothing, and governance that ignores the legal framework leaves you exposed.

This guide does not re-explain what data governance is (that is the subject of our article on lightweight governance in 3 pillars). It answers a different question: how a Belgian SME wires its GDPR compliance onto that governance, without a full-time DPO or a large-group budget.

GDPR and governance: what is the actual link

The two are often confused, wrongly. The GDPR is a European law: it states what you must respect when you process personal data. Data governance is an internal practice: it organizes who decides, who accesses, and how the data is kept current.

The link is simple. Almost every GDPR obligation assumes you already know where your data is. You cannot answer an erasure request if you do not know which tools hold a customer's address. You cannot set a retention period without having mapped your files. Governance is not an add-on to the GDPR, it is what makes it applicable.

In Belgium, the Data Protection Authority (APD/GBA, in Brussels) enforces and sanctions. It expects from an SME not the perfection of a multinational, but a serious, documented effort.

What the GDPR actually requires of an SME

Set the broad principles aside and look at the obligations that translate into actions. Six really matter.

• The record of processing activities. You must list your personal-data processing: which ones, for what purpose, which categories of people, for how long. An exemption exists in theory for companies under 250 employees, but it falls away as soon as the processing is regular (payroll, customers, prospecting), which is the case everywhere. In practice, your SME has to keep a record.
• A legal basis per processing. Each use of data rests on a justification: consent, contract, legal obligation, legitimate interest. No basis, no processing.
• Retention periods. You do not keep data "just in case." Each category has a defined duration, after which it is deleted or archived.
• Individuals' rights. Access, rectification, erasure, portability: you must be able to answer a request within one month. That means locating the data, so knowing where it is.
• Security. Proportionate measures: access control, encryption where relevant, backups. A customer file accessible to the whole company is a classic breach.
• Processors. Every third-party tool that handles your data (CRM, host, emailing service) must be framed by a contract organizing that processing.

None of these obligations calls for a five-figure law firm. They call for order.

Wiring compliance onto lightweight governance

This is where governance does the work. The three pillars of lightweight governance (cataloguing, quality, access) carry almost all GDPR compliance, provided you look at them through the regulatory lens.

Cataloguing your data is already the raw material of your record of processing: the same mapping serves both. Data quality overlaps with the GDPR accuracy principle, which requires you to keep data correct and up to date. And access management answers directly to the security obligation and the minimization principle, under which everyone accesses only what they need.

In other words, you are not running two projects. You are running a single governance effort, and documenting it so it also answers to the APD. For the week-by-week mechanics of setting it up, the how-to is in our article on the 3 pillars of lightweight governance.

The new reflex: GDPR plus AI

A point many SMEs forget in 2026: the AI tools you use also process personal data. An assistant that reads your emails, a chatbot that answers your customers, a service that analyzes your contracts: each is a processing activity to enter in your record, with its legal basis and its processor framing.

Two moves cover the essentials. First, check in the vendor's terms that your data is not used to train its public models. Second, ban, through an internal policy, the injection of sensitive data into consumer AI tools. This topic keeps growing: the EU AI Act comes fully into force by August 2026 and adds its own obligations, detailed in our guide on what the EU AI Act requires of SMEs.

The three most common GDPR gaps in SMEs

On the ground, the same holes come back, and they are never the sophisticated ones.

The first is the customer file accessible to the whole company. A shared spreadsheet where everyone sees everything, including the intern and the salesperson who just joined. It is a direct breach of the minimization principle, and the kind of detail that gets noticed fast in an inspection. Restricting access takes an hour and closes the risk.

The second is the absence of retention periods. Candidate CVs kept for five years, prospect data never purged, former customers sitting in the CRM for a decade. Keeping "just in case" is not a legal basis. Each data category must have a defined duration and a planned deletion.

The third is the unframed processor. Do you use an emailing tool, a host, a cloud CRM? Each processes data on your behalf and must be bound by a contract organizing that processing. Most serious vendors offer one, but you still have to have signed it and filed it.

None of these three gaps requires a project. Each is fixed in a few hours, provided you know it exists.

Where to start

Four workstreams, in this order, cover the essentials for a Belgian SME.

• The record. List your processing activities and their purpose. A structured spreadsheet is enough to begin.
• The durations. Set a retention period per data category and plan the deletion.
• The AI tools policy. One page stating what can and cannot be injected into a third-party AI tool.
• The access. Check who accesses what and tighten wherever everyone sees everything.

None of these demands an outsized budget. They demand a method and a bit of rigour. If you want us to scope your compliance starting from your real data, that is exactly what we do: a support engagement for data structuring and governance. Book a 30-minute discovery call, and we will tell you where to start on your case.