GDPR is the law that controls how businesses collect, store and use personal data in the UK. In short, if your business holds information that can identify a living person, GDPR applies to you. That includes customer names, email addresses, phone numbers, payment details and even IP addresses. This guide explains GDPR in plain English, with no legal jargon, so a small business owner can understand what to do and what to avoid.
This article is general information, not legal advice. It explains the rules as they apply to most small businesses. If you handle sensitive data at scale, or you face a complex case, speak to a qualified adviser. For most small firms, though, good habits cover most of the risk.
GDPR in one paragraph
The UK GDPR, together with the Data Protection Act 2018, sets the rules for personal data in the UK. It gives people rights over their data, and it puts duties on any business that decides how and why that data is used. The regulator is the Information Commissioner’s Office, known as the ICO. The core idea is simple: collect only the data you need, be honest about why you collect it, keep it safe, and delete it when you no longer need it. Most compliance work is just putting that idea into everyday routines.
You may also hear the term UK GDPR. After Brexit, the UK kept its own version of the law. It works much like the EU version, but the ICO enforces it in the UK. If you also serve customers in the EU, separate EU rules may apply to that data. This article focuses on the UK position for a UK small business.
What counts as personal data
Personal data is any information that relates to an identifiable living person. A name on its own can count. So can an email address, a phone number, a home address, a photo, a location record or an online identifier such as an IP address. Data that has been truly anonymised, so no one can link it back to a person, falls outside the rules. Data that is only pseudonymised, for example replaced with a code, still counts, because someone could reverse it.
Some data gets extra protection. This is called special category data. It includes health information, racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetic and biometric data, and data about sex life or sexual orientation. Most small businesses do not need this kind of data at all. If you do collect it, you need a stronger lawful reason, and you should take extra care with security. A good rule is simple: if you do not need it, do not collect it.
Think about the data your business already holds. Customer orders, enquiry forms, email lists, staff records, CCTV footage and website analytics can all contain personal data. Listing these sources is the first step to managing them well. You do not need fancy software for this. A simple written record of what you hold, why you hold it and how long you keep it is a strong start.
The six principles in plain English
GDPR rests on six principles. They sound formal, but each one translates into a practical habit.
1. Lawful, fair and transparent
You must have a lawful reason to use personal data, you must treat people fairly, and you must tell them what you do with their data in clear language. A privacy notice on your website covers the transparency part. It should say what you collect, why you collect it, how long you keep it and who you share it with. Keep it short and honest. If a customer cannot understand it, rewrite it.
2. Purpose limitation
Collect data for a specific, stated purpose, and do not reuse it for something unrelated. If someone gives you an email address to receive an order confirmation, you cannot add them to a marketing list without a proper basis. New purposes need fresh justification, and often fresh consent.
3. Data minimisation
Collect only what you need. If a contact form does not need a date of birth, do not ask for it. Fewer fields mean less risk, less storage and simpler compliance. Review your forms once a year and remove fields you never use.
4. Accuracy
Keep data accurate and up to date. Let customers correct mistakes easily, and remove data you know is wrong. A simple way to do this is to check details at each contact, and to act quickly when someone tells you something has changed.
5. Storage limitation
Keep data only as long as you need it. Set retention periods and stick to them. For example, you may need invoices for tax purposes for several years, but you probably do not need old marketing contacts for ever. Delete or anonymise data when its purpose ends. A regular clear out, once or twice a year, keeps this manageable.
6. Integrity and confidentiality
Keep data secure. Use strong passwords, two factor authentication, encrypted devices and access controls, so only staff who need data can reach it. This principle is where good cybersecurity habits and GDPR meet. Our small business cybersecurity checklist covers the practical steps in plain language.
There is also a seventh duty, called accountability. It means you must be able to show that you follow the principles. Written records, a privacy notice, staff training notes and a simple data log all help you prove compliance if the ICO ever asks.
What it means for your small business
For most small businesses, GDPR compliance comes down to a short list of actions. First, map your data. Write down what personal data you hold, where it lives, why you hold it and who can access it. Second, publish a clear privacy notice and keep it up to date. Third, secure your systems with passwords, updates, backups and access controls. Fourth, train anyone who handles customer data, even if your team is only two people. Fifth, plan for requests and incidents before they happen.
People have rights over their data. They can ask for a copy of it, ask you to correct it, ask you to delete it in some cases, object to some uses and restrict processing while a dispute is resolved. You normally have one month to respond to a request. Most requests are simple, such as a customer asking what data you hold about them. Having a simple process, and knowing who handles requests, makes this painless.
If you use suppliers who process data for you, such as an email platform, a booking system or a cloud provider, you need a written contract with them. That contract should say they only process data on your instructions and keep it secure. Reputable providers offer standard data processing terms. Check that yours are in place, and note where your data is stored.
If you suffer a data breach, such as a lost laptop or an unauthorised access to customer records, you may need to report it to the ICO within 72 hours of becoming aware of it, where it poses a risk to people. You should also tell affected people directly if the risk is high. A short written incident plan, with contact details and first steps, saves panic later. For the first aid steps after a security incident, see our guide on how to spot phishing emails, since phishing is one of the most common ways breaches start.
Consent: what you actually need
Consent is only one lawful basis for using data, and it is not always the right one. Other bases include contract, legal obligation and legitimate interests. For example, you do not need consent to process an order a customer placed. You need a contract basis for that. Consent matters most for marketing.
Valid consent must be freely given, specific, informed and clear. Pre ticked boxes do not count. Silence does not count. The person must take a clear positive action, such as ticking an unticked box. You must also make it as easy to withdraw consent as it was to give it. Keep a record of when and how consent was given, so you can prove it later.
For email and text marketing, the Privacy and Electronic Communications Regulations, known as PECR, sit alongside GDPR. In most cases you need consent before sending marketing messages to individual consumers, unless the soft opt in applies to existing customers for similar products. Business to business rules differ in detail, so check the position for your audience before you send. Our guide to AI scams to watch out for in the UK also shows why trustworthy consent practices matter, because scam messages often abuse the same channels.
Fines: what really happens
Headline fines sound alarming. The ICO can fine up to 17.5 million pounds, or 4 percent of annual worldwide turnover, whichever is higher, for the most serious infringements. A lower tier, up to 8.7 million pounds or 2 percent of turnover, applies to other infringements. In practice, those maximum figures target large and serious cases, not a small shop that made an honest mistake and fixed it.
For most small businesses, the realistic outcome of a problem is different. The ICO often starts with advice, warnings or enforcement notices that tell a business to fix a specific issue. Fines follow where a business ignores warnings, causes serious harm or shows a pattern of carelessness. Taking prompt action, keeping records and cooperating fully all count in your favour.
The real cost of a breach is often not a fine at all. It is lost customer trust, time spent fixing the problem, and the disruption of a security incident. That is why prevention is cheaper than cure. Strong passwords, staff awareness, backups and a simple data map protect both your customers and your business.
FAQs
Does GDPR apply to my tiny business?
Yes, if you process personal data. There is no general exemption for small businesses. Some record keeping duties are lighter for firms with fewer than 250 employees, unless processing is regular or risky, but the core principles and people’s rights apply to everyone.
Do I need to register with the ICO?
Most organisations that process personal data must pay an annual data protection fee to the ICO, unless an exemption applies. The fee depends on your size and turnover, and small businesses usually pay the lowest tier. Check the ICO fee checker to confirm your position.
Can I still send marketing emails to customers?
Yes, with a proper basis. Consent is the usual route for new contacts, while the soft opt in may cover existing customers for similar products. Always include a clear unsubscribe option, and stop promptly when someone opts out.
What should my privacy notice include?
It should state who you are, what data you collect, why you collect it, your lawful basis, how long you keep it, who you share it with, and how people can exercise their rights. Keep it in plain English and update it when your practices change.
What do I do if someone asks for their data?
Treat it as a data subject access request. Confirm their identity, gather the data you hold about them, and respond within one month. If the request is complex, you may extend the deadline by two further months, but you must tell the person within the first month.
Conclusion
GDPR is not a mountain of paperwork. It is a set of common sense duties: be honest about data, collect only what you need, keep it safe, and respect people’s rights. Start with a data map, a clear privacy notice and basic security habits. Review them once a year. Do that well, and you protect your customers, your reputation and your business, while staying on the right side of the law.
