A plain-English look at what GDPR compliance actually requires from UK small businesses, and where the common gaps tend to sit.