UK GDPR and Data Protection for Small Businesses

If your business collects, stores, or uses information about individuals — customers, employees, or website visitors — you must comply with UK GDPR and the Data Protection Act 2018. This guide explains your obligations in plain English.

1. Do you need to comply?

If you process personal data about individuals in the UK, UK GDPR applies to you. Personal data is any information that relates to an identifiable living person — names, email addresses, phone numbers, IP addresses, location data, CCTV footage, and financial information all count.

Very limited exemptions apply:

• Purely personal or household activity (keeping your own address book) — no business exemption
• Some small clubs and societies with limited personal processing

In practice, almost every business needs to comply. The key question is not whether UK GDPR applies, but how to comply proportionately for your size and risk level.

ICO registration: Most businesses that process personal data must pay the ICO data protection fee: £40/year for small organisations, £60 for medium, £2,900 for large. Check the ICO's self-assessment tool — some organisations are exempt (e.g. manual-only records, certain charities).

2. The 6 lawful bases for processing

Every instance of personal data processing must have a lawful basis. The six lawful bases under UK GDPR are:

Important:Choose the correct lawful basis before you start processing — you cannot switch bases later. You cannot “stack” multiple bases for the same processing activity. If you rely on consent, withdrawing consent must stop the processing.

Legitimate interests is the most flexible basis for many business uses (e.g. direct marketing to existing customers, fraud prevention, network security). You must conduct and document a Legitimate Interests Assessment (LIA) to confirm the balance test is met.

3. The 7 key principles

Article 5 of UK GDPR sets out seven principles that must underpin all processing:

1. Lawfulness, fairness and transparency — you must have a lawful basis, not deceive individuals, and be open about how you use their data
2. Purpose limitation — only collect data for specified, explicit, and legitimate purposes; do not use it for incompatible new purposes without further justification
3. Data minimisation— collect only what is adequate and relevant for the purpose; do not collect data “just in case”
4. Accuracy — keep personal data accurate and up to date; correct or erase inaccurate data promptly
5. Storage limitation — do not keep personal data longer than necessary; set and follow retention schedules
6. Integrity and confidentiality — protect data against unauthorised access, loss, or destruction using appropriate technical and organisational measures
7. Accountability — you must be able to demonstrate compliance; document your decisions and processes

4. Privacy notices

You must provide individuals with a privacy notice (or “privacy policy”) at the time you collect their data. This must include:

• Who you are and your contact details (and DPO contact if applicable)
• What personal data you collect and why
• Your lawful basis for processing
• How long you will keep the data (or the criteria you use to determine this)
• Who you share the data with
• Details of any international transfers
• The individual's rights and how to exercise them
• The right to complain to the ICO

Write privacy notices in plain, clear English — the ICO can take enforcement action against overly legalistic or unclear notices. Use a layered approach for complex processing: a short summary at the point of collection linking to the full notice.

5. Individual rights

UK GDPR gives individuals the following rights, all of which you must be ready to honour:

• Right of access (Subject Access Request) — individuals can request a copy of all personal data you hold about them; you must respond within 1 month (extendable by 2 months for complex cases); no fee for most SARs
• Right to erasure (“right to be forgotten”) — individuals can request deletion where data is no longer necessary, consent is withdrawn, or there is no legitimate interest; not absolute — legal obligations can override it
• Right to rectification — individuals can request correction of inaccurate personal data
• Right to restriction of processing — individuals can ask you to stop processing in certain circumstances while a dispute is resolved
• Right to data portability — where processing is based on consent or contract and carried out by automated means, individuals can receive their data in a structured, machine-readable format
• Right to object — individuals can object to processing based on legitimate interests or direct marketing; direct marketing objections must always be honoured immediately
• Rights related to automated decision-making — individuals have the right not to be subject to solely automated decisions that significantly affect them (e.g. automated loan decisions) without human review

6. Data retention

You must not keep personal data longer than necessary. Set and follow documented retention schedules. Common minimum retention periods required by law or best practice:

After the retention period, data must be securely deleted — for digital data, this means overwriting or cryptographic erasure; for paper, cross-cut shredding.

7. Third parties — processors and controllers

When you share personal data with third parties who process it on your behalf (payroll bureaux, cloud software providers, email marketing platforms, IT support firms), you must have a Data Processing Agreement (DPA) in place. The DPA must specify:

• The subject-matter and duration of processing
• The nature and purpose of processing
• The type of personal data involved
• The obligations of both parties

International transfers: If personal data leaves the UK (for example, data stored on US servers), you need safeguards. Acceptable safeguards include: UK adequacy decisions (for countries with equivalent protection), Standard Contractual Clauses (SCCs), or Binding Corporate Rules. Check whether your software providers are processing data outside the UK.

8. Data breaches

A personal data breach is any security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access to personal data. Your breach response plan should include:

1. Contain and assess — stop the breach and assess what data was affected and the likely risk
2. Notify the ICO within 72 hoursif the breach is likely to result in a risk to individuals' rights and freedoms
3. Notify affected individuals without undue delay if the breach is likely to result in a high risk to them
4. Document internally — all breaches must be logged, even low-risk ones that do not require notification

The 72-hour clock starts from when you become aware of the breach, not when it happened. If you cannot provide all information within 72 hours, you can notify in phases.

9. ICO registration

Register at ico.org.uk/registration. Failure to register when required carries a fine of up to £4,000.

10. Practical steps for SMEs

1. Data audit — map what personal data you collect, where it is stored, who has access, and how long you keep it
2. Update your privacy notice — ensure it covers all your processing activities and is clearly accessible on your website
3. Review consent mechanisms — pre-ticked boxes and bundled consent are not valid under UK GDPR
4. Check your lawful bases — document which basis you rely on for each processing activity
5. Sign DPAs with all processors — check your contracts with software providers, accountants, and IT suppliers
6. Appoint a responsible person — designate someone internally to handle SARs and breach responses (a full DPO is not required for most SMEs)
7. Train your team — staff who handle personal data should understand the basics of UK GDPR and know how to spot a breach
8. Register with the ICO — confirm whether you need to pay the data protection fee and register if so
9. Create a breach response plan — know in advance who is responsible, how to contain breaches, and how to notify the ICO
10. Document everything — the accountability principle requires you to demonstrate compliance; keep records of decisions, assessments, and training

The ICO has extensive free guidance at ico.org.uk, including a free self-assessment tool for SMEs.