SMOOTH · Project

Automated GDPR Compliance Platform That Audits Small Businesses in Minutes

digitalPilotedTRL 7

Imagine you run a tiny shop or freelance business and suddenly GDPR rules say you could be fined up to 4% of your income if you handle customer data wrong — but you can't afford a lawyer to figure it all out. SMOOTH built a cloud tool that automatically scans how your business handles personal data — your website, emails, cookies — and tells you exactly what's wrong and how to fix it. Think of it like a tax preparation app, but for privacy compliance. It uses machine learning to read your online presence and generate a custom compliance report, so a 3-person company gets the same protection that big corporations pay consultants thousands for.

By the numbers

93%

of European enterprises are micro-sized (fewer than 10 employees) — the target market

of annual income — maximum GDPR fine that micro enterprises risk

30%

of EU employment provided by micro enterprises

21%

of EU value added generated by micro enterprises

consortium partners across 6 countries

total project deliverables produced

The business problem

What needed solving

Micro enterprises — the 93% of European businesses with fewer than 10 employees — face GDPR fines of up to 4% of their annual income but cannot afford lawyers or consultants to ensure compliance. Most don't even know what their specific obligations are, leaving them exposed to enforcement actions that could shut them down.

The solution

What was built

A fully functional cloud platform that uses machine learning, text mining, and automated online auditing to generate bespoke GDPR compliance reports for micro enterprises. The project also delivered a practical GDPR interactive handbook as a website and mobile app tailored specifically to small businesses.

Audience

Who needs this

RegTech and compliance-as-a-service companies looking to serve the micro enterprise segmentE-commerce platforms wanting to offer GDPR compliance tools to their sellersBusiness associations and chambers of commerce supporting small business membersInsurance companies offering cyber liability products to small businessesAccounting and bookkeeping firms advising micro enterprise clients on regulatory compliance

Business applications

Who can put this to work

E-commerce & Online Retail

SME

Target: Small online shops and marketplace sellers processing customer data

If you are a small e-commerce business collecting customer names, addresses, and payment details — this project developed a cloud platform that automatically audits your website, cookie policies, and data handling practices against GDPR requirements. It generates a bespoke compliance report showing exactly where you fall short and what to fix, helping you avoid fines that can reach 4% of your annual income.

Professional Services & Consulting

SME

Target: Freelancers, accountants, and small consultancies handling client data

If you are a micro consultancy or accounting firm managing sensitive client records but lack the budget for a dedicated Data Protection Officer — this project built an automated auditing tool that uses machine learning to assess your data protection practices. It produces a tailored GDPR compliance report and provides practical materials for fixing gaps, designed specifically for businesses with fewer than 10 employees.

Data Protection & RegTech

any

Target: RegTech companies and GDPR compliance service providers

If you are a regulatory technology provider looking to serve the massive market of micro enterprises — this project created a validated cloud platform with machine learning-based auditing that could be white-labeled or integrated into existing compliance offerings. The platform was designed with Data Protection Authorities as partners and tested by actual micro enterprises across 6 European countries.

Frequently asked

Quick answers

What would it cost a small business to use this platform?

The project was designed specifically to address the fact that micro enterprises lack resources for GDPR compliance. The platform is cloud-based and automated, which suggests a low-cost SaaS model. Based on available project data, specific pricing was not disclosed, but the entire value proposition is affordability for businesses with fewer than 10 employees.

Can this scale to serve thousands of small businesses across Europe?

Yes — the platform was built as a cloud service specifically to serve the 93% of European enterprises that are micro-sized. The automated machine learning approach means each new business can be audited without manual effort. The consortium spans 6 countries, suggesting multi-language and multi-jurisdiction design.

Who owns the technology and can it be licensed?

The platform was developed by a 12-partner consortium led by Fundacio Eurecat in Spain. The project produced 35 deliverables including a fully functional running platform. Licensing terms would need to be negotiated with the consortium, likely led by the coordinator.

Does this actually meet GDPR legal requirements?

The consortium included Data Protection Authorities as partners, which gives the platform strong regulatory credibility. The tool was designed and validated by actual micro enterprises, and it focuses on the most critical GDPR aspects relevant to small businesses. This is not legal advice, but the regulatory involvement in development is a strong signal.

How long has this been in development and what's the current status?

The project ran from May 2018 to January 2021 and is now closed. It delivered both an interim and a final version of the SMOOTH cloud platform, described as a fully functional running platform. The project website smoothplatform.eu may have information on current availability.

Can this integrate with existing business tools or websites?

The platform uses online auditing methods to automatically scan a business's digital presence — websites, data collection forms, cookie policies. Based on available project data, it operates as a standalone cloud service that analyzes your existing online presence rather than requiring deep integration into your IT systems.

Is there ongoing support or is this just a research prototype?

This was funded as an Innovation Action, which targets near-market solutions. The final deliverable is described as a fully functional running platform, not just a prototype. However, the project ended in January 2021, so ongoing support depends on whether the consortium has continued commercial operations.

Consortium

Who built it

The 12-partner consortium spans 6 countries (Belgium, Germany, Spain, France, Latvia, Poland), giving it broad European coverage. With 3 industry partners and 2 SMEs alongside 2 universities and 2 research organizations, it balances technical development with market understanding. The 5 "other" partners likely include the Data Protection Authorities and micro enterprise associations mentioned in the objectives — a smart move that builds regulatory credibility directly into the product. The coordinator, Fundacio Eurecat, is a Spanish research and technology center, well-positioned to bridge research and commercialization.

FUNDACIO EURECATCoordinator · ES
ASOCIACION ESPANOLA DE NORMALIZACIONparticipant · ES
FUNDACION IMDEA NETWORKSparticipant · ES
NAVER FRANCEparticipant · FR
FUNDINGBOX ACCELERATOR SP ZOOparticipant · PL
NEC LABORATORIES EUROPE GMBHparticipant · DE
KATHOLIEKE UNIVERSITEIT LEUVENparticipant · BE
UNIVERSIDAD CARLOS III DE MADRIDparticipant · ES
LSTECH ESPANA SLparticipant · ES

How to reach the team

Fundacio Eurecat (Spain) — a technology center, likely has a business development or licensing office reachable through their main website.

Order a report on this consortium See FUNDACIO EURECAT profile →

Next steps

Talk to the team behind this work.

Want to explore licensing SMOOTH's technology for your compliance service offering, or need help connecting with the development team? SciTransfer can arrange an introduction and help structure the conversation.

Order a report on this topic More in Digital & ICT