Data Protection & UK GDPR for Small Businesses

What data protection actually means for a small business

If you hold information about people — customers, enquiries, staff, suppliers — then UK data protection law applies to you. It does not matter whether you have two employees or two hundred. The rules are set out in the UK GDPR and the Data Protection Act 2018, and they are overseen by the Information Commissioner’s Office (the ICO).

The good news is that compliance is mostly common sense written down: know what personal data you hold, have a good reason for using it, keep it secure, be honest with people about what you do, and respond properly when someone asks. This hub walks through each part in plain English and links to detailed guides where you need more depth.

If you are new to all of this, start with our plain-English guide to GDPR basics for UK small businesses, then come back here to fill in the specifics.

Registering with the ICO

Most businesses that process personal data must pay a data protection fee to the ICO and register their details. For small organisations this is usually a modest annual amount, and not paying it is one of the most common — and most avoidable — reasons small firms end up on the ICO’s radar. It takes a few minutes to sort out on the ICO website, and it is the first practical step towards being compliant.

Having a lawful reason to use data

You cannot use personal data just because you have it. Every use needs a lawful basis — one of six legal grounds such as consent, contract, legal obligation or legitimate interests. Choosing the right one matters, because it affects the rights people have and what you must tell them. Our guide to lawful basis for processing personal data, explained shows how to pick the right basis for everyday situations like taking orders, sending marketing or paying staff.

Being honest: your privacy notice

People have a right to know what you do with their information. A privacy notice is simply a clear page on your website that explains what you collect, why, how long you keep it, who you share it with and how someone can exercise their rights. It does not need to be full of legal jargon — plainer is better. Our guide on how to write a privacy notice for a small business gives you a practical structure to follow.

When someone asks to see their data

Anyone can ask you for a copy of the personal data you hold about them. This is called a subject access request, or SAR, and you normally have one month to respond, free of charge. SARs can feel daunting the first time — especially if the request is broad or comes from a disgruntled customer or ex-employee — but there is a clear process. Read how to handle a subject access request so you are not caught out.

Assessing risk before you start something new

When you plan something that could carry higher risk to people’s privacy — new CCTV, large-scale profiling, or a new system holding sensitive data — you may need a Data Protection Impact Assessment (DPIA). It is a short, structured way to think through the risks before you commit. Our DPIA guide explains when one is required and how to complete it without over-complicating things.

Do you need a Data Protection Officer?

Many small businesses do not legally need a formal Data Protection Officer, but some do — and everyone benefits from having someone clearly responsible. The guide on whether you need a Data Protection Officer helps you work out where you stand and what the alternatives are.

Websites, cookies and marketing rules

Data protection is not only about GDPR. If your website uses cookies or analytics, or you send marketing emails and texts, the Privacy and Electronic Communications Regulations (PECR) also apply. That means proper cookie consent and sensible marketing practices. Our guide to cookies and PECR for UK business websites covers what your cookie banner actually needs to do.

Using US-hosted tools and cloud services

Almost every small business uses tools hosted overseas — email, storage, CRM, accounting, marketing platforms. Sending personal data outside the UK is entirely lawful, provided you rely on an appropriate transfer mechanism such as the UK’s adequacy arrangements or the ICO’s International Data Transfer Agreement (IDTA). In practice, the reputable providers you already use have this covered; you just need to understand and document it. Our guide to international data transfers under UK GDPR clears up the common myths.

Data protection and security go together

Keeping data lawful is only half the job — you also have to keep it secure. Strong passwords, multi-factor authentication, backups and staff awareness are what turn a policy into real protection. It is worth reading these alongside our hubs on cyber security, email security and managed IT, since a breach is both a security incident and a data protection one. Our cyber security services can help you put the right safeguards in place.

Where to start

If all this feels like a lot, that is normal — you do not have to fix everything at once. Get registered with the ICO, write an honest privacy notice, know how you would answer a SAR, and make sure your systems are secure. From there, work through the guides above at your own pace.

Want a hand getting the basics right? Book a free IT and security review and we will help you find the gaps and prioritise the fixes — in plain English, with no jargon and no pressure.