Every small business that holds information about customers, staff or suppliers has data protection duties under UK GDPR and the Data Protection Act 2018. For most, the essentials are manageable: know what data you hold and why, tell people how you use it, keep it secure, pay the ICO fee if it applies, and know what to do if something goes wrong.
This is an overview for small businesses, not legal advice. The Information Commissioner’s Office, the UK regulator, publishes the authoritative guidance, and some of it is being reviewed after the Data (Use and Access) Act 2025 became law in June 2025, so always check the ICO’s current pages.
Know what you hold and why
Start with a list of the personal information the business holds: customer contact details, staff records, CCTV, enquiry forms, payment details. For each, note where it is kept, who can see it, why you need it and how long you keep it.
That one spreadsheet answers most of the questions that come later. It also tends to turn up data you no longer need and can delete.
Tell people how you use their data
Your website needs a privacy notice that says what you collect, why, who you share it with, how long you keep it and how people can exercise their rights. Staff need their own version. Copying another company’s notice rarely works, because it will describe their data and not yours.
Check whether you need to pay the data protection fee
The ICO says organisations, “including sole traders”, that use personal information need to pay a data protection fee unless they are exempt (ICO, data protection fee). Its free self assessment tells you whether you need to pay and how much. Being exempt from the fee does not remove your other data protection duties.
Keep it secure
The security problems I come across in small businesses are rarely sophisticated. Shared logins mean nobody knows who did what. Email and key systems have no two step verification. Customer details sit in personal WhatsApp chats and on personal phones. Staff who left months ago can still get in. Paper files live in an unlocked cabinet in a shared office.
Each of those is cheap to fix, and together they account for most of the everyday risk.
Know what to do if something goes wrong
A personal data breach can be as ordinary as an email sent to the wrong person or a lost laptop. The ICO’s guidance is that you must assess the likely risk to people’s rights and freedoms, and “if a risk is likely, you must notify us, as soon as possible, and where feasible within 72 hours” (ICO, personal data breaches).
Write a one page breach plan now, while things are calm:
- Who staff tell, straight away, if they think something has gone wrong.
- How you contain it, such as recalling the email or resetting passwords.
- Who assesses the risk and decides whether to report.
- How you record what happened, what you decided and why.
Keep a log of every breach and near miss, including the ones you decide not to report. It shows you take it seriously, and over a year it shows you where the same mistakes keep happening.
Make it a habit
Review the data list once a year, remove access the day someone leaves, spend ten minutes on data protection at a team meeting now and then, and update the privacy notice whenever you change how you use data. Small and regular beats a big clean up every few years.
