Automation for small business: where to start, and what to leave alone

“Automating” sounds big, but most of the gain is in small, boring tasks: an enquiry you have to retype by hand, an appointment confirmation you write again each time, a reminder you forget. This article helps you decide where to start, how to keep it small and where you had better let people do what people do well. It is not a sales pitch for tools: we name no time savings or percentages, because those depend on your business and your processes. What we do is line up the questions you must answer before you connect anything.

What is automation, actually?

It is a fixed sequence of steps that a system carries out as soon as something happens: a form is submitted, a payment arrives, a date is reached. The steps can be simple (send a confirmation email) or composite (create a customer record, schedule a task, send a message). An automation is not smart; it does exactly what is configured. That is an advantage, because you can predict and test it, and a disadvantage, because it does not notice when something odd happens.

How far along is small business already?

Statistics Netherlands (CBS) publishes figures on ICT use in companies each year. Its 2026 report shows, for example, that 80 percent of companies with 10 or more employed persons support remote working, and that 33 percent used one or more AI technologies in 2025. These are provisional figures and only concern companies with 10 or more employed persons; smaller businesses are not included. So take it as context, not as a norm: you do not have to do anything just because others do.

Choose your first automation with four questions

1. Does it happen often? A task that occurs once a year is rarely worth it.
2. Is it always the same? The more exceptions, the harder to automate. Start with the clear cases.
3. What goes wrong if it goes wrong? A wrong confirmation email is annoying; a wrong invoice is worse. Start with low risk.
4. How do you notice when it stops? An automation that fails silently is more dangerous than no automation.

Good first candidates

• A confirmation after an enquiry. An immediate email to the visitor with what happens now and when they will hear something.
• A notification for yourself. An enquiry arrives and you get a message where you already look.
• Data in one place. An enquiry goes into an overview (a spreadsheet or a CRM) instead of only your inbox.
• Reminders. An appointment tomorrow, a quote still open, an invoice about to fall due.
• Recurring reports. The weekly overview of enquiries or visitors, automatically in your mail.

Such a chain usually starts at the form on your website. How to build that well is in A landing page that produces enquiries. Make sure email really arrives; see email delivery: SPF, DKIM and DMARC.

What should you leave alone?

• A conversation with a hesitating customer. That is not a process, it is a relationship.
• Decisions with consequences. A quote with a price, a rejection or a complaint needs a person.
• Anything you do not yet understand yourself. A chaotic process becomes a fast chaotic process after automation. Make it clear first.
• Things that are different every time. The more variants, the more exception rules, the greater the chance that maintenance takes more time than it saves.

Privacy and the GDPR

An automation moves data, and that is processing personal data in the sense of the GDPR. A few points from the regulation that often apply: data must be limited to what is necessary (data minimisation, article 5), a party that processes data for you is a processor with whom you need an agreement (article 28), and you must take appropriate security measures (article 32). In practice:

1. Know where your data goes. Every connection (form, email tool, spreadsheet, CRM) is a place where data sits.
2. Do not pass on more than needed. Does the next step really need the phone number?
3. Record it in your privacy statement and arrange processor agreements where needed. See cookies and GDPR for your website.
4. Decide how long you keep data and clear it out.

This is general information, not legal advice.

Security

The OWASP Top 10 (2025 edition) names, among others, “Security Misconfiguration” and “Software Supply Chain Failures”. For an automation that translates into: keys and passwords stored in a tool, connections with too many permissions and third-party components you do not keep up to date. Give each connection only the permissions it needs, use two-step verification, remove connections you no longer use and watch for notices from the NCSC and from your suppliers. More in website security: the basics.

Test and monitor

An automation you do not test is a gamble. Test with real examples, including an empty value, a long name and a strange character. Make sure a failed step produces a notification and that someone knows what to do. Keep track of which automations are running, what they do and who manages them. Without that overview nobody knows after a year why a message is being sent.

Build it small and expand

Start with one chain, let it run for a few weeks and see what you notice. Measure what counts: does it really save time, are there fewer errors, do customers get answers faster? For ads, Google describes that you decide yourself what a valuable action is; the same principle applies here: decide beforehand what “better” means. Only then apply the next step. On measuring, read privacy-friendly web analytics.

Accessibility of what you automate

Automation often starts with a form, and that must be usable for everyone. The W3C Web Accessibility Initiative explains that clear labels and instructions help with filling in correctly, including for users of speech input or a screen reader. A form that is not accessible does not work and therefore also passes nothing on to your automation.

A thought example: from enquiry to appointment

Suppose a small service provider with a contact form. Without automation the enquiry lands in an inbox, is copied by hand and answered only later. With a simple chain this happens: the form sends the data to one place, the visitor immediately gets a confirmation with an expected response time, and you get a notification. If no reply has been sent after a few days, a reminder follows for you, not for the customer. This is an illustrative example, not a result we promise; what it yields depends on how you set it up. It does show that a good automation is above all a reliable sequence, with a person at the place where it matters.

When do you bring in help?

If you notice you spend more time maintaining loose connections than on what they solve, or if data spreads across multiple systems, it is time for a second pair of eyes. We build and manage automations for small businesses, and provide hosting and maintenance behind them. Book a free intro call.

A short checklist

• One clear task chosen, with low risk.
• Do you know where the data goes?
• Is there a notification on failure?
• Are permissions and access limited?
• Is it in your privacy statement?
• Is there an overview of what is running?
• Have you agreed how you will know it works?

Sources

Reviewed on 28 October 2026 against the sources below. Rules and guidelines change; this article is general information, not legal or tax advice.

• General Data Protection Regulation, Regulation (EU) 2016/679 (EUR-Lex)
• OWASP Top 10:2025
• Nationaal Cyber Security Centrum (NCSC)
• 3. ICT-gebruik bij bedrijven (CBS, 2026)
• About conversion tracking (Google Ads Help)
• Forms Tutorial (W3C Web Accessibility Initiative)

Book an intro call