A small business handles personal information throughout a normal working day: an enquiry in an inbox, a delivery address, an employee’s emergency contact or a customer record in accounting software. UK GDPR compliance for small businesses begins with understanding these everyday activities, not buying an expensive compliance package.
The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and related rules apply to organisations handling personal data, including sole traders. The Data (Use and Access) Act 2025 has also changed aspects of the rules. Your task is to explain why you use information, protect it and respect people’s rights.
Start with a map of your information
Before copying a privacy policy template, list what personal data enters your business, where it is stored and who receives it. Include customer records, staff details, website enquiries and information processed by external services. Personal data can include an identifiable person’s email address or online identifier, not just their name.
For each activity, record its purpose, source, users, suppliers and intended retention period. A spreadsheet is often enough to start, even where full formal processing records are not mandatory.
Imagine a plumbing company. Its bookings system stores addresses for appointments, accounting software keeps invoices and an email platform holds newsletter subscribers. These activities serve different purposes and may require different lawful bases and retention decisions.
Choose a lawful basis before collecting data
Processing personal data requires a valid lawful basis. Common options for small businesses include contract, legal obligation, legitimate interests and consent. Other bases cover vital interests and public tasks; reforms introduced a recognised legitimate interests basis for specified public-interest purposes.
A delivery address may be needed to perform a customer contract. Tax records can involve a legal obligation. Legitimate interests requires consideration of necessity and the impact on individuals. Consent fits activities where people have genuine choice and can withdraw it.
Do not claim consent for everything. The correct basis depends on the activity, and direct marketing also has separate rules. Processing health information or other special category data generally requires an additional condition. Record your reasoning before collecting information.
Make your privacy notice useful
Your notice should identify the business and explain what information you collect, why, your lawful bases, recipients, retention periods and people’s rights. Explain complaints and international transfers where relevant. Put privacy information where people provide details, such as a booking form or checkout.
Check the wording against your real systems. If enquiries now flow into a customer management platform but the notice mentions only email, update it. A privacy notice checklist for UK businesses is a useful companion to this process.
Collect less and decide when to delete it
Data minimisation means requesting what you actually need. Newsletter subscribers rarely need to provide a date of birth. Avoid giving staff access to customer information unrelated to their jobs.
Set practical retention rules for enquiries, orders, employment records and marketing lists. Certain accounting records must be retained for legal reasons, but an abandoned enquiry should not stay in a database indefinitely. Document the rationale rather than applying one arbitrary deletion date to everything.
Protect information without overcomplicating security
Use multifactor authentication for email and cloud accounts, unique passwords, software updates, restricted access and tested backups. Consider device encryption and secure disposal of old equipment. The appropriate measures depend on the sensitivity and volume of data you handle.
Make an incident plan before one is needed. If an employee emails a customer list to the wrong recipient, the team should know who investigates, how to contain the mistake and where to record the decision. Training staff to recognise these situations is as useful as buying new software.
Be ready for access requests and complaints
People can ask to see their personal data and may have rights to correction, erasure, restriction or objection, depending on the circumstances. A subject access request can be verbal and need not mention GDPR. Generally, respond without undue delay and within one month, subject to permitted extensions or pauses. Searches must be reasonable and proportionate.
Assign responsibility for logging requests, checking identity when necessary and sending responses securely. A guide to handling subject access requests can help employees avoid overlooking informal enquiries.
Since June 2026, organisations must also offer a clear procedure for data protection complaints, acknowledge complaints within 30 days, investigate appropriately and communicate the outcome. Even a small firm needs a visible contact route and a complaints log.
Review processors and international transfers
A payroll provider, web host or email platform may handle information on your instructions. In that situation, written data processor agreements are generally required. These must cover matters including documented instructions, confidentiality, security, subprocessors, assistance with rights and breaches, and deletion or return of data when services end.
Check whether suppliers transfer information outside the UK. Depending on the destination and circumstances, you may need adequacy regulations or appropriate safeguards and an assessment. Using a well-known software service does not automatically resolve these obligations.
Do not overlook marketing, cookies and breaches
The Privacy and Electronic Communications Regulations (PECR) add requirements for electronic marketing and website tracking. Check when consent is needed and when a specific exception applies. A privacy notice alone does not authorise every marketing email or tracking technology.
If a personal data breach is likely to risk individuals’ rights and freedoms, it generally must be reported to the Information Commissioner’s Office (ICO) within 72 hours of awareness, where feasible. Higher-risk cases may require informing individuals. Record incidents and decisions even when reporting is unnecessary. A small business data breach response plan makes this manageable.
Keep records and revisit your decisions
Keep evidence of lawful-basis choices, privacy notices, supplier terms, security reviews, training and responses to requests. Assess whether the ICO data protection fee applies to your business; exemptions exist, but being small is not itself a blanket exemption.
Review your arrangements whenever you introduce a new platform, process sensitive information or change your marketing. Higher-risk projects may require a data protection impact assessment.
Frequently asked questions
Does UK GDPR apply to sole traders?
Yes. Sole traders processing personal data within the law’s scope must comply. Having only one worker or a handful of clients is not a general exemption.
Does every small business need a data protection officer?
No. Formal appointment is required only in specified circumstances, including certain large-scale monitoring or sensitive-data processing. Someone should still take responsibility for day-to-day compliance.
Is a privacy policy enough?
No. A notice explains your activities, but data protection compliance also requires lawful processing, security, retention decisions, suitable supplier arrangements and procedures for rights and complaints.
Must every business pay the ICO fee?
Not always. Many controllers must pay, but exemptions depend on the processing involved. Check the ICO’s official fee self-assessment instead of assuming your business qualifies.
Build habits that survive a busy week
Start with a data inventory, then address the greatest risks: weak account security, unexplained uses of information, missing supplier terms or unanswered requests. Small, documented improvements reviewed regularly are more valuable than a polished policy nobody follows.