GDPR applies to you the moment you collect one email address from one person in the EU. There is no small-business exemption. There is no threshold you stay under. That is the whole reason this page exists, because most solopreneur privacy advice is written either for a company with a legal department or for someone who has never read the regulation.
What follows is the version I actually run: which four things are non-negotiable, what they cost, and the specific places where growth tactics quietly break the rules.
Table of Contents
Organic, compounding traffic on autopilot. No ads, no daily posting, ever.
Get the avalanche →The Four Things That Are Actually Non-Negotiable
Almost everything written about GDPR is a summary of the regulation. That is not useful when you are one person deciding what to do on a Tuesday. Four obligations carry nearly all the real risk for a solo operator.
1. A lawful basis for every piece of data you hold. For a solopreneur this is almost always consent or legitimate interest. Consent must be a positive action. A pre-ticked box is not consent. A checkbox bundled with the terms of service is not consent.
2. A record of that consent. Not the fact of it, the evidence of it: what the person agreed to, when, and what the form said at that moment. If your email tool does not store the form wording alongside the timestamp, you cannot prove anything later.
3. Deletion on request, inside 30 days. This is the one that catches people, because your data is never in one place. It is in the email tool, the CRM, the checkout provider, a Google Sheet and an old CSV in your downloads folder.
4. Breach notification inside 72 hours. To the regulator, and to affected users if the risk is high. The clock starts when you become aware, not when you finish investigating.
Everything else on this page exists to make those four things survivable for one person with no legal team.
Why People Ignore This, And Why That Reasoning Is Wrong
The usual argument is that regulators go after Meta, not a solo operator with 400 subscribers. That is mostly true and it is still the wrong way to think about it.
Enforcement rarely starts with a regulator. It starts with one annoyed person who asked to be deleted and got ignored, then filed a complaint that costs them nothing to file. The asymmetry is the point: a complaint is free for them and expensive for you.
There is also a demand side to this that the compliance framing misses completely. Pew Research Center found 79% of adults are very or somewhat concerned about how companies use the data they collect on them, and 81% say they have very little or no control over it. That is your list. Four out of five people handing you an email address already assume you will misuse it.
The Consent Problem Nobody Wants To Hear About
Here is the finding that should change how you write a signup form. In the same Pew Research work, only 9% of adults say they always read a privacy policy before agreeing to it and 13% say they often do. 36% say they never read one. Of the people who do read them, only 22% read all the way through, and 97% report being asked to approve policies in the first place.
So the document you paid someone to write is read in full by roughly one person in twenty. Consent that is technically valid and practically uninformed is exactly the thing regulators have been tightening on, and it is also just a bad deal for the person signing up.
What I do instead is put the substance at the point of collection, in one line next to the button, in plain words: what I will send, how often, and that they can leave in one click. The full policy still exists because it has to. The line next to the button is the part that does the actual work.
Where Growth Tactics Actually Break The Rules
This is the section the generic guides skip. These are the specific tactics that create a problem, in the order I see people get caught.
Scraped lists. Buying or scraping emails gives you no lawful basis at all. There is no cure for this after the fact. You cannot email people to ask for consent to email them.
Custom audience uploads. Uploading your list to an ad platform is a new processing purpose. If your signup form said “weekly newsletter”, it did not say “and we will hand your email to an advertising platform”.
Retargeting pixels firing before consent. A pixel in your site header runs on page load, which is before anyone has clicked anything on your banner. That is the single most common technical violation on small sites and it is a five-minute fix in your tag setup.
Cold outreach under legitimate interest. Business-to-business cold email can be defensible in some jurisdictions. It stops being defensible when you cannot explain, in one sentence, why this specific person would reasonably expect to hear from you.
Lead magnets bundled with a newsletter. Getting a checklist and getting on a mailing list are two purposes. Bundling them into one unavoidable checkbox is the pattern regulators call out by name.
The Data Map: One Spreadsheet, One Hour, Once
You cannot honour a deletion request across systems you have not written down. So write them down. This is genuinely one spreadsheet and it takes about an hour.
Five columns: the tool, what personal data it holds, the lawful basis, how long you keep it, and how you delete a single person from it. Then fill one row per tool. Email platform, CRM, checkout, analytics, support inbox, form builder, scheduler, and every abandoned tool you still have an account with.
The abandoned tools are where the real exposure sits. The trial CRM from two years ago with 2,000 contacts in it is still your responsibility, and it is the one you will forget when someone asks to be erased.
The reason this matters operationally rather than legally: Asana’s Anatomy of Work surveyed 9,615 knowledge workers and found people move through 10 different apps a day and lose 62% of the workday to repetitive tasks. Ten apps is also roughly ten places a single deletion request has to reach. Doing that by memory, under a 30-day clock, is how people end up saying it is done when it is not.
What This Actually Costs
The honest number, for a one-person business, in three parts.
Setup, four to six hours. The data map, rewriting your signup forms, fixing pixel firing order, and a privacy policy. A generated policy is fine as a starting point and it is not fine if you never edit it to match the tools you actually use.
Money, usually between nothing and a few hundred. A consent manager, and a lawyer read if you are handling health, financial or children’s data. If you are selling a course to adults, you probably do not need the lawyer.
The upkeep nobody budgets, about an hour a quarter. Every new tool adds a row to the map. This is the part that decays, and a stale data map is worse than no data map because it makes you confident about something untrue.
The Four Numbers To Watch
Unsubscribe rate. Rising means your consent was weaker than you thought. People are telling you they did not expect this.
Time to fulfil a deletion request. Measure it once, honestly, with a stopwatch. If it is over an hour of your time, your data map is wrong or your tools are.
Number of tools holding personal data. This should go down over time. Every tool you cancel is one fewer row and one fewer breach surface.
Consent records you could produce on demand. Pick three subscribers at random and try to produce the evidence. If you cannot do it for three, you cannot do it for three thousand.
What Happens When Someone Actually Asks To Be Deleted
The request will not arrive as a legal notice. It arrives as a reply to a newsletter saying “please remove me and delete whatever you have on me”. That sentence starts a 30-day clock, and most people handle the first half of it and quietly skip the second.
Unsubscribing is not deleting. Every email platform keeps unsubscribed contacts on file, by design, so it can honour the suppression. That is a legitimate reason to retain an email address and it is not the same as erasure of everything else you hold.
The procedure I follow, in order. Confirm receipt the same day, in one line, so the clock is visibly acknowledged. Open the data map and work down the rows rather than from memory. Delete in each system and note the date next to the row. Keep a minimal suppression record, which is the email address and nothing else, because you need it to avoid contacting them again. Then reply once to say it is done and name the systems.
The last step is the one that prevents a complaint. A person who gets a specific answer stops. A person who gets silence goes looking for the form that costs them nothing to file.
One exception worth knowing: you can refuse erasure of records you are legally required to keep, and invoices are the common case. Tax law usually requires you to hold them for years. Say that plainly rather than deleting something you will need.
The Other Regimes, And Why You Probably Only Need To Know One
GDPR is not the only regulation, and chasing all of them is how solo operators waste a week on this.
UK GDPR is close enough to EU GDPR that meeting one effectively meets the other for a small operator. CCPA and CPRA in California are built around a right to opt out of the sale or sharing of data rather than a right to opt in, which mostly means a clear link on your site and honouring it. PIPEDA in Canada and the LGPD in Brazil both track GDPR closely on the points that matter to a one-person business.
The practical shortcut: build to GDPR, which is the strictest of them on consent, and you are substantially compliant with the rest. Then add the one California-specific opt-out link if you sell there.
What you should not do is run four different consent flows by visitor location. That is a project for a company with an engineering team, and for a solopreneur it creates four things to maintain and four things to get wrong.
The Tools, And What Each One Is Actually For
Three categories, and you do not need all three on day one.
A consent manager controls when your pixels and analytics fire. This is the one worth paying for, because doing it manually in tag settings is where the mistakes live.
Your email platform is your consent record, provided it stores the form wording and timestamp together. Check this before you trust it. Several popular tools store the timestamp and not what the person actually agreed to, which leaves you with half the evidence.
A password manager plus two-factor on every tool holding personal data is the boring one, and it prevents the breach that starts the 72-hour clock in the first place.
Notice what is absent from that list: a compliance platform with a monthly subscription. For a one-person business those solve a reporting problem you do not have yet.
Compliance Is A Conversion Lever, Not Just A Cost
Being straight about data is a competitive advantage on a list where four in five people expect to be misused.
The mechanism is the same one that governs every other part of an online business. Shopify found 79% of customers are less likely to buy again after one bad experience. Finding out you sold their email is a bad experience. It does not produce a complaint. It produces silence and no second purchase.
A smaller list of people who genuinely opted in outperforms a bigger list of people who did not, on every metric that ends in revenue. That is not a compliance argument. That is just how lists work.
When To Actually Hire Someone
Three situations justify paying a professional, and one does not.
Pay someone if you handle health, financial or biometric data. Pay someone if you process data on children. Pay someone if you have received a formal complaint or a regulator letter, because that is not the moment to learn on the job.
Do not pay someone to write a policy for a newsletter and a course. That is a template and an hour of your attention, and a consultant will produce a document that is longer, not safer.
I run my own business across jurisdictions and talk through how I handle the operational side on the Freedom by Choice podcast. The longer write-ups are on my Substack.
Your First Week
Day one: build the five-column data map. Every tool, including the dead ones.
Day two: cancel and purge the tools you no longer use. This removes more risk than anything else on the list.
Day three: fix consent at the point of collection. Unbundle the lead magnet from the newsletter, add the plain-language line next to the button.
Day four: check when your pixels fire. Before consent is the default in most setups and it should not be.
Day five: write your deletion procedure as a numbered checklist, then run it on yourself and time it.
That is the whole thing. It is not a legal project. It is an afternoon of admin you do once and an hour a quarter after that.
Frequently Asked Questions
What GDPR rules apply to growth hacking for solopreneurs?
GDPR requires explicit consent before collecting personal data, the right to erasure upon request, data minimization (collect only what is needed), and transparent privacy policies. Solopreneurs must appoint a data processor, maintain consent records, and report breaches within 72 hours regardless of business size.
What are the penalties for GDPR violations in marketing?
GDPR fines can reach 20 million euros or 4% of global annual turnover, whichever is higher. Even solopreneurs face enforcement actions. In 2024, over 2,000 fines were issued across Europe. Smaller violations typically result in warnings first, but repeat offenders face escalating penalties and reputational damage.
How can solopreneurs collect leads while staying GDPR compliant?
Use double opt-in forms, clearly state how data will be used, provide easy unsubscribe options, and never buy email lists. Offer valuable lead magnets in exchange for explicit consent. GDPR-compliant lead generation actually improves quality, with opted-in leads converting 30% higher than cold contacts.
Do privacy regulations apply to social media growth hacking?
Yes, privacy regulations cover social media data collection, retargeting pixels, custom audience uploads, and direct messaging campaigns. Platforms like Facebook and Instagram require advertisers to confirm data compliance. Always use platform-native tools for targeting and avoid scraping user data from social profiles directly.
About the Author
Martin Ebongue is the founder of martinebongue.com, an online business and lifestyle design blog focused on helping aspiring entrepreneurs build location-independent businesses. Since 2014, he has been creating and scaling online ventures across multiple niches, from digital products and affiliate marketing to SaaS and content platforms, while traveling the world. He shares the real-world strategies, tools, and systems that work, with a particular focus on AI-powered automation for solopreneurs. Follow him on YouTube, X (Twitter), and Instagram.
Related Reading
- What Are The Key Principles Behind Growth Hacking For Solopreneurs?
- How Can Solopreneurs Efficiently Scale Their Business Without Getting Overwhelme
- How Can Solopreneurs Conduct A/B Testing In Marketing Automation?
- What Are Some Common Marketing Automation Pitfalls That Solopreneurs Should Avoi
Want the tools that run my whole business?
Every system I sell, organized by what you need next. Most are under $30 to start.
See the full catalog →
