SMEs face multiple challenges related to cybersecurity and personal data protection. Prominent amongst these challenges is the lack of appropriate guidelines addressing specific SME requirements. The proposed RE methodology aspires to bridge this gap by establishing a generic process specifically targeting SMEs needs and capabilities. This paper describes the conceptual foundation of the methodology and reports on the way that the theoretical foundations were applied on an SME offering social care services.