UK GDPR and the Data Protection Act 2018 apply to almost every business that handles personal data: customer names and emails, staff records, enquiry forms, even a list of contacts on a phone. You do not need a legal team to start. This guide to GDPR for small businesses in the UK is a practical checklist covering the basics. It is general information, not legal advice.
1. Know what personal data you hold
Make a simple list: what data, where it lives (email, accounting software, spreadsheets, your website), who can see it and why you have it. You cannot protect or explain data you have not mapped.
2. Decide your lawful basis
For each use of personal data you need a lawful reason, such as a contract, a legal obligation, consent or legitimate interests. Write down which one applies. The ICO has guidance aimed at small organisations.
3. Check whether you must pay the ICO data protection fee
Most organisations that process personal data have to pay a data protection fee to the ICO unless an exemption applies. The ICO has a short self-assessment to check.
4. Publish a clear privacy notice
People should be able to find out who you are, what data you collect, why, who you share it with, how long you keep it and how to exercise their rights. Put it where they will see it, for example in the footer of your website. Keep it accurate: only list what you really do.
5. Collect only what you need and keep it only as long as needed
Review forms and spreadsheets for data you do not use. Set sensible retention periods and delete old records on a schedule.
6. Secure the data
UK GDPR expects “appropriate” security. In practice that means MFA, updates, backups, access controls and trained staff. Our guide to cyber security for small businesses gives a practical starting list.
7. Check your suppliers
If a supplier handles personal data for you, for example a mailing service, hosting company or accountant, make sure there is a written agreement and that you know where the data goes.
8. Be ready for rights requests
People can ask to see, correct or delete their data. Know who handles such requests and how to find a person’s data across your systems.
9. Have a breach plan
If a breach puts people at risk, you may need to report it to the ICO within 72 hours of becoming aware of it. Decide in advance who investigates, who decides, and who tells affected people. The ICO explains how to report a breach.
10. Train your people and review regularly
Most incidents involve a human mistake. Short, regular training, plus a yearly review of this list, keeps you on track.
Where an audit helps
A GDPR audit looks at how your systems and processes handle personal data and highlights gaps. It is a technical and practical review, not legal advice. Security and GDPR compliance includes GDPR audits and vulnerability reviews for small organisations across Cambridgeshire and the UK.
Common GDPR mistakes small businesses make
- Collecting data “just in case” and never deleting it.
- Sending customer lists in unprotected spreadsheets by email.
- Using one shared login for everyone on a system that holds personal data.
- Copying a privacy notice from another business without checking it matches what you actually do.
- Having no process for subject access requests, so they land on whoever sees them first.
- Forgetting about data on old laptops, phones and USB sticks.
Documents worth keeping
You do not need a mountain of paperwork, but a few short records make life far easier and show you take data protection seriously: a list of the personal data you hold and why, your privacy notice, supplier agreements, a retention schedule, your breach plan and a record of staff training. Keep them somewhere you can find them in a hurry.
Local organisations and GDPR
Schools, community groups, clubs and charities across Cambridgeshire handle personal data too, often with volunteers and shared devices. The same principles apply: know what you hold, keep it secure, tell people how you use it and be ready to respond if something goes wrong.
Frequently asked questions
Does GDPR apply to a sole trader?
Yes, if you handle personal data in the course of your business, though the details depend on what you do. Check the ICO’s small-organisation guidance.
Do I need a data protection officer?
Only in specific circumstances set out in the legislation. Most small businesses do not, but you still need someone responsible for data protection.
Is my website covered?
Yes. Contact forms, analytics, cookies and customer accounts can all involve personal data.
GDPR for small businesses: not sure where you stand?
Call me and we will talk through your systems and what a GDPR audit would look at.