How long does GDPR compliance realistically take for a small shop?

The biggest technical misconception is cookie banners. Just putting up a banner isn't enough. You have to block Google Analytics or external retargeting pixels at the browser level until the user clicks accept. Sorting this out with off-the-shelf open-source plugins can easily eat up 2-3 days of testing.

As a wholesaler of a similar size in Birmingham, we went through this last year. It took 6 weeks in total. We spent around 30 hours in-house and only paid an outside lawyer 450 GBP to review our finalized documents. The only thing that took longer than anticipated was re-verifying consent for our old newsletter subscribers.

Open a spreadsheet right now and set up these columns: Data type purpose of collection, where it’s stored, who it’s shared with, and retention period. In official terms, this is called a RoPA (Record of Processing Activities). Until you fill this out, hiring a lawyer or drafting policies is a total waste of time.

Definitely don't waste your money on sites claiming to make you GDPR compliant in 24 hours. Copy-pasting a privacy policy doesn't make you compliant. If there's a complaint the Information Commissioner’s Office (ICO) won't care about the fancy legal jargon on your site—they'll look at how data is stored on your server and your agreement with your courier.

keep an eye on your shipping carrier integration turns out when we were syncing customer addresses automatically they were sitting unpurged in their portal for 3 years, took us two weeks just to catch that and set up an auto-delete rule.

Edit: asked below, I wrote the answer in the second message.

What exactly was the inquiry from Germany asking for? Was it just a general privacy question, or did they submit a formal Data Subject Access Request (DSAR)? If it's a formal request, you need to respond within the statutory deadline regardless of where you are in your compliance schedule.

dont let it intimidate you, it feels like a mountain for a team of 4 but honestly a focused weekend gets half the map drawn out but anyway the ICO site has a brilliant checklist for small businesses, we just went through that step by step.

Two years ago when a customer from France asked us to erase their entire order history we thought we had to delete the invoices too. Our accountant warned us: you can't delete data subject to statutory tax retention periods. We wiped the marketing data and archived the invoice records. Getting that distinction clear from the get-go saves a ton of time.

I'll argue the opposite, don't get mad. The real issue isn't the number, but what it's based on.

Payment information changes are never verified through the channel they came from. If I were you, I'd go this route.

There are three things to check when doing this. Mistakes made on the GDPR compliance timeline side are usually reversible but expensive.

Just leaving this note, it might be useful.

You're right.

i agree with this... honestly don't rely on a single measure; go layer by layer.

that's all sorry if I went on too long.

Could you elaborate on that? When making a decision, first look at what data you have on hand.

Proven by experience.

The cheap-looking path usually ends up costing more later. Hasty decisions become decisions you have to fix six months later.

Taking notes for two weeks yields better results than a six-month estimate.

The answer above hits the nail on the head. Processes without records never improve, because you don't know what to fix.

Just leaving this note, it might be useful.

Just a heads-up... When you try to change everything at once, nothing settles.

Good luck with that.

I have a question, don't want to go off-topic though. Just because everyone does it doesn't mean it's right.

If you post the result here, it will help others too.

It's rare to find an explanation this clear. Your time to detect an issue directly determines its cost.

Just leaving this note it might be useful.