Understanding Data Protection Duties for Small Businesses

Why data protection is part of everyday business

When you run a small business, personal data turns up everywhere. It is in your customer orders, your staff rota, your supplier contacts and your marketing list. Under the UK GDPR and the Data Protection Act 2018, you have legal duties whenever you handle information that can identify a living person. These duties are not just for large corporations. They apply to sole traders, partnerships and limited companies alike.

Good data protection is also good business. Customers trust you more when they know their details are safe. Staff feel respected when their records are handled properly. And a clear approach saves time if someone asks what information you hold about them.

Know what personal data you hold and why

You cannot protect what you have not mapped. Start by writing a simple record of the personal data your business uses. For each type, note where it came from, why you have it, who you share it with, and how long you keep it. This is sometimes called a record of processing activities. It does not need to be complicated. A spreadsheet is fine.

Common categories for a small business include:

• Customer names, addresses, email addresses and phone numbers
• Order histories, payment details and delivery instructions
• Employee and contractor records, including payroll and holiday data
• Marketing preferences and website enquiry forms
• CCTV footage if you have cameras on your premises

Only collect what you actually need. If you do not need a customer's date of birth, do not ask for it. Delete or anonymise data when you no longer need it. This principle is called data minimisation, and it reduces risk straight away.

Choose a lawful basis for each purpose

Every time you use personal data, you need a lawful basis. There are six under the UK GDPR. The most common for small businesses are:

• Contract – you need the data to fulfil an order or provide a service.
• Legal obligation – you must keep records for tax, employment or health and safety law.
• Legitimate interests – you have a genuine business reason that does not override the individual's rights, such as fraud prevention.
• Consent – the individual has clearly agreed, for example to receive a newsletter.

Consent must be freely given, specific, informed and unambiguous. A pre-ticked box is not consent. Nor is silence. If you rely on consent, keep a record of when and how it was given. And make it easy for people to withdraw consent later. For other bases, document your reasoning so you can show you have thought it through.

Keep personal data secure

Security does not have to mean expensive software. It means taking reasonable steps to protect data from loss, theft or unauthorised access. The right measures depend on your size and the sensitivity of the data. Practical steps include:

• Use strong, unique passwords and turn on two-factor authentication for email and cloud accounts.
• Encrypt laptops, phones and portable drives. Encrypt any personal data you send by email.
• Limit access so staff only see the data they need for their role.
• Keep software and devices updated with the latest security patches.
• Back up important data regularly, and test that you can restore it.
• Train staff to spot phishing emails and to report lost devices immediately.
• Have a clear desk policy for paper records, and lock them away when not in use.

Write down your security measures in a simple policy. Review it once a year or when you change how you work. If you use a cloud provider or accountant, check they have appropriate safeguards too. You remain responsible for the data you share with them.

Responding to requests about personal data

Individuals have rights over their personal data. They can ask for a copy of what you hold, request corrections, ask you to delete it, or object to certain uses. The most common request is a subject access request. When you receive one, you must respond within one month. You can normally do this free of charge. If the request is complex, you may extend the deadline by two further months, but you must tell the person why.

Before responding, verify the person's identity. Do not send data to someone who might not be who they claim to be. Provide the information in a clear, portable format. If it contains details about other people, redact those parts. Keep a note of the request and your response. If you refuse a request, explain your reasons and tell the person they can complain to the Information Commissioner's Office.

What to do if something goes wrong

Mistakes happen. A laptop is lost, an email goes to the wrong customer, or a file is accidentally deleted. If a breach occurs, act quickly. Assess the risk to the people whose data is involved. If there is a risk to their rights and freedoms, you must report it to the Information Commissioner's Office within 72 hours of becoming aware of it. If the risk is high, you must also tell the affected individuals without undue delay.

Keep an internal breach log, even for minor incidents. It shows you are monitoring and improving. Many small businesses also need to pay an annual data protection fee to the regulator, unless they are exempt. Check the current rules and set a reminder. Finally, remember that data protection is an ongoing duty. Review your records, refresh your training, and ask for advice when you are unsure. Doing the basics well protects your customers, your staff and your reputation.