IT policies for a small business in the EU: which ones you need and what goes in them

Why write them down at all

EU law rarely names an "IT policy", but several duties are easier to meet with one. Under GDPR Article 32 you must take appropriate technical and organisational measures to secure personal data, and Article 24 asks you to be able to demonstrate compliance. Article 33 requires you to notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk. Customers that fall under NIS2 must also check the security of their direct suppliers (Article 21(2)(d)), which is why policy questions now arrive in customer questionnaires.

ENISA's Cybersecurity guide for SMEs sets out twelve practical steps, among them a good cybersecurity culture, training, third-party management, an incident response plan and secure backups. The six documents below turn those steps into rules your staff can follow.

The six documents

1. Acceptable use policy

What staff may do with company accounts, devices, email and software. Cover who may install software, how to handle information (three labels are enough: public, internal, confidential), rules for generative AI tools, a call-back check before paying to a changed bank account, how to report a mistake without blame, and what you monitor.

2. Passwords, MFA and access

Long, unique passwords kept in a password manager, and no forced changes on a fixed schedule. MFA on email, cloud services and remote access first. Separate admin accounts, and an access review when someone changes role or leaves.

3. Remote work and own devices

Pick a model: company devices only, personal devices for email and files under conditions, or full bring your own device. Set minimums such as screen lock, updates and encryption. State what the employer can and cannot see or wipe on a personal phone.

4. Backup and recovery

Per system: what is backed up, how often, how long it is kept, and how fast you need it back. Keep at least one copy out of reach of ransomware, check whether your cloud services' terms leave backups to you, and test a restore on a schedule.

5. Incident response plan

Roles, a printed contact list, and steps from detection to recovery. Add a notification check: the data protection authority within 72 hours for a personal data breach that may pose a risk, customers as the contract says, your insurer, and only if you are in scope of NIS2, the 24-hour early warning and 72-hour notification under Article 23.

6. Staff one-pager and acknowledgement

The rules that matter most, on one page, signed by each employee on their first day. This is the document people actually read.

What US templates miss

Most free templates that rank for this search are written for US businesses. Three points need a European version:

• Monitoring. The GDPR requires transparency and prior information to staff about what is monitored, why and for how long data is kept (Articles 5 and 13). Article 88 lets member states set more specific rules for employee data, and in some countries a works council has a say. A clause such as "employees have no expectation of privacy" does not fit.
• Deadlines. Your incident plan needs the GDPR's 72 hours and, if you are in scope, NIS2's 24 and 72 hours, not US state breach laws.
• References. ENISA, your national cybersecurity agency and ISO/IEC 27001:2022, rather than NIST or HIPAA. A short table that maps each policy to the GDPR, NIS2 Article 21(2) and ISO/IEC 27001 Annex A saves time when a customer questionnaire arrives.

Make them stick

Policies in a shared folder change nothing by themselves. Give each measure an owner and a due date, put recurring tasks (restore tests, access reviews, the yearly policy review) in a calendar, and use a checklist for joiners, movers and leavers so that accounts are closed on someone's last day. Review your suppliers too: who has access to your systems or data, and what you know about their security.