Step 4: Get Your Privacy Notice Right (and Make It Readable)
Your privacy notice is your public explanation of how your business uses personal data. It is one of the most visible and important GDPR documents you have, and it plays a key role in meeting the transparency requirements of UK GDPR.
For small businesses, the biggest mistake is not missing information, but making the notice too legal, too long or too hard to understand. GDPR expects clarity, not complexity. If a real person cannot easily understand what you are doing with their data, the notice is not doing its job.
At a minimum, a compliant privacy notice should clearly explain:
- What personal data you collect – For example names, contact details, payment information or website usage data.
- Why you collect it – The specific purposes, such as providing services, responding to enquiries or meeting legal obligations.
- Your lawful bases for processing – Link each purpose to the correct lawful basis, such as contract, legal obligation or legitimate interests.
- Who you share data with – This should be categories of recipients, such as accountants, IT providers, hosting companies or payment processors.
- International data transfers – Explain whether data is transferred outside the UK and what safeguards are in place, if applicable.
- How long you keep personal data – Set out retention periods or explain the criteria used to determine them.
- Individual rights – Explain rights such as access, rectification, erasure and objection, and how people can exercise them.
- How to complain – Include the right to complain to the Information Commissioner’s Office, with a link to the ICO complaints page.
- How to contact you – Provide clear contact details for data protection queries, even if you do not have a formal Data Protection Officer.
The ICO’s broader UK GDPR guidance is an excellent reference point for what a good privacy notice looks like in practice. You can find it in the ICO Guide to Data Protection.
A strong privacy notice uses plain English, short paragraphs and clear headings. Avoid copying generic templates without tailoring them to how your business actually operates. If your data practices change, your privacy notice should be updated to reflect that.
Practical tip for small businesses. Place a link to your privacy notice everywhere you collect personal data. This includes contact and enquiry forms, lead magnets, newsletter sign-ups, checkout pages, proposal and contract signature tools, and recruitment forms. Transparency works best when people see the information at the moment their data is being collected.
When done properly, a privacy notice does more than satisfy GDPR. It builds trust, reduces confusion, and helps customers and clients feel confident about how your business handles their information.
Step 5: Respect People’s Data Rights (and Prepare Before the First Request Arrives)
One of the core aims of GDPR is to give individuals meaningful control over their personal data. As a small business, you may not receive requests often, but when you do, you must be ready to handle them properly and within the required timeframes.
Under UK GDPR, individuals have a range of rights, commonly referred to as data subject rights. These include:
- The right to access their personal data
- The right to rectification of inaccurate or incomplete data
- The right to erasure in certain circumstances
- The right to restrict processing
- The right to object to processing
- The right to data portability, where applicable
The ICO provides detailed but practical guidance on these rights in its individual rights guidance.
You do not need a large or complex procedure to comply, but you do need a consistent and documented approach. Preparing in advance is far easier than trying to work things out after a request lands in your inbox.
A sensible small business process should include:
- Deciding who handles requests – Make it clear internally who is responsible for receiving and responding to data rights requests.
- Verifying identity proportionately – Check that the requester is who they claim to be, without collecting excessive additional data.
- Logging the request – Record the date received, the type of request and the statutory deadline for responding.
- Searching all relevant systems – This may include your CRM, email inboxes, shared files, ticketing systems, accounting software and cloud storage.
- Responding clearly and on time – Most requests must be completed within one month, unless an extension is justified and communicated.
If you completed the data map in Step 1, this process becomes significantly easier. Knowing where personal data is stored means you can locate it quickly and respond accurately without unnecessary delay.
It is also good practice to have a simple internal record of requests, even if you receive very few. This supports the accountability principle and shows you take data protection seriously.
Practical tip. Train anyone who handles customer enquiries or emails to recognise a data rights request, even if it is not labelled formally. A request does not have to mention GDPR or use specific wording to be valid.
Handled well, data rights requests do not need to be disruptive. With a clear plan in place, most small businesses can manage them efficiently and confidently, while demonstrating respect for the individuals whose data they hold.
Step 6: Data Minimisation and Retention (Stop Keeping Data “Just in Case”)
One of the quieter but most important GDPR principles is data minimisation and storage limitation. In plain terms, this means you should only collect the personal data you actually need, keep it only for as long as there is a genuine reason to do so, and then dispose of it securely.
Many small businesses fall into the habit of keeping data indefinitely because storage is cheap and deletion feels risky. GDPR actively discourages this approach. Holding onto personal data without a clear purpose increases your compliance risk and your exposure if something goes wrong.
Under UK GDPR, you are expected to ensure that personal data is:
- Relevant and limited to what is necessary
- Kept accurate and up to date
- Not kept for longer than needed for its purpose
- Deleted, erased or anonymised securely once no longer required
A practical way to manage this is to create a basic data retention schedule. This does not need to be complicated. It is simply a written record of how long different types of data are kept and why.
Typical small business examples include:
- Sales enquiries – Often retained for 6 to 12 months in case of follow-up or dispute, then securely deleted.
- Marketing subscribers – Kept until the individual unsubscribes, with a short tidy-up period to ensure records are fully removed.
- Customer contracts and invoices – Retained in line with legal and tax obligations, such as HMRC record-keeping requirements.
- HR and staff records – Retention depends on the type of record and relevant employment law considerations.
GOV.UK provides guidance on statutory retention requirements for business and tax records, which helps justify longer retention where legally required. See HMRC record keeping guidance.
The ICO also expects organisations to think deliberately about retention, even where exact time periods vary. Its guidance on storage limitation and retention is available in the ICO data protection principles guidance.
You do not need perfect precision. What matters is that your approach is considered, documented and applied consistently across your systems.
Practical tip. Build retention into your routine. Schedule regular reviews of inboxes, CRMs, shared drives and marketing platforms. If data no longer serves a clear purpose, remove it securely rather than letting it linger indefinitely.
By stopping the habit of keeping data “just in case”, you reduce risk, improve security and make GDPR compliance significantly easier to maintain over time.
Step 7: Put Proper Security in Place (Practical, Not Paranoid)
GDPR does not expect small businesses to operate like large enterprises with dedicated security teams. What it does expect is that you put in place appropriate technical and organisational measures that reflect the type of data you hold and the level of risk involved.
In plain English, your security should be sensible, proportionate and actively maintained. Overcomplicating things often leads to poor adoption, while doing too little leaves you exposed to avoidable breaches.
The ICO is clear that many data breaches occur due to basic failures rather than advanced cyber attacks. For most small businesses, getting the fundamentals right dramatically reduces risk.
Strong security basics for small businesses include:
- Multi-factor authentication (MFA) – Enable MFA on email accounts, CRMs, hosting platforms, finance systems and cloud storage wherever it is available.
- Password management – Use a reputable password manager and ensure all accounts have unique, strong passwords.
- Device encryption – Encrypt laptops, desktops and mobile devices to protect data if a device is lost or stolen.
- Role-based access control – Only give people access to the data and systems they need to do their job. This is often referred to as the principle of least privilege.
- Regular updates and patching – Keep operating systems, software, plugins and apps up to date to reduce known vulnerabilities.
- Backups and recovery testing – Back up important systems regularly and test restores to ensure data can actually be recovered when needed.
- Staff training and awareness – Phishing emails remain one of the most common causes of breaches. Basic training can make a significant difference.
- Supplier and third-party checks – Carry out basic due diligence on IT support providers, hosting companies and software suppliers that handle personal data.
Security also includes what happens when someone leaves your business or changes role. Access should be removed promptly, devices returned, and passwords or credentials reset where appropriate. Many incidents happen simply because old accounts remain active.
The ICO’s guidance on security measures and breach prevention is a useful reference point for small organisations. See the ICO security guidance.
Practical tip. Write down your security measures, even briefly. This supports the accountability principle and helps demonstrate that your approach is deliberate rather than accidental.
When security is treated as an ongoing process rather than a one-off task, it becomes easier to manage and far less intimidating. Practical, well-maintained controls are far more effective than overly complex systems that no one understands or uses properly.
Step 8: Use the Right Contracts with Suppliers and Processors
Most small businesses rely on third-party suppliers to run day-to-day operations. Email marketing platforms, CRMs, cloud storage, payroll software, hosting providers and IT support often process personal data on your behalf.
Under UK GDPR, if you are a data controller and a supplier processes personal data for you, that supplier is usually acting as a data processor. In these cases, GDPR requires you to have a contract in place that includes specific data protection terms.
In practice, this is often handled through a provider’s standard Data Processing Agreement or their broader terms and conditions. The key point is that the required clauses must exist and be accessible.
Processor contracts should cover things such as:
- Processing data only on your documented instructions
- Keeping personal data secure
- Using appropriate technical and organisational measures
- Rules around sub-processors
- Assistance with data rights requests and breaches
- Data deletion or return at the end of the contract
The ICO explains these requirements in its guidance on contracts between controllers and processors, available here.
A practical way to stay on top of this is to keep a simple vendor or supplier list. This does not need to be complex, but it should give you a clear overview of who has access to personal data and under what terms.
Your vendor list might include:
- Supplier name – The organisation providing the service.
- What personal data they process – For example customer contact details, employee payroll data or website analytics.
- Where the supplier is based – Including whether data is processed inside or outside the UK.
- Links to their DPA or security information – So you can quickly review their data protection commitments.
- Renewal or review dates – To prompt periodic checks that the arrangement is still appropriate.
This approach supports the accountability principle and makes it far easier to respond if the ICO ever asks how you manage third-party risk.
Practical tip. When choosing new suppliers, check their data protection and security pages before signing up. If this information is hard to find or unclear, that in itself can be a warning sign.
By keeping your supplier arrangements clear and documented, you reduce risk and demonstrate that your business takes responsibility for personal data, even when it is processed by others.
Step 9: Direct Marketing (GDPR and PECR Working Together)
When it comes to marketing, GDPR is only part of the picture. In the UK, the Privacy and Electronic Communications Regulations (PECR) sit alongside GDPR and often have a more direct impact on how you can carry out email, SMS and similar forms of digital marketing.
In simple terms, GDPR focuses on how you process personal data, while PECR sets specific rules for electronic marketing and tracking technologies. You need to comply with both.
The ICO provides clear guidance on how these rules interact in its Guide to PECR.
For small businesses, a practical and compliant approach to direct marketing includes:
- Keeping evidence of opt-ins where required – This is especially important for consumer email and SMS marketing. You should be able to show when, how and what someone consented to.
- Making unsubscribe options clear and effective – Every marketing email must include a simple way to opt out, and unsubscribe requests should be actioned promptly.
- Separating service messages from marketing – Emails about invoices, account updates or service delivery are not marketing. Do not bundle promotional content into them unless you have a lawful basis to do so.
- Being cautious with bought or third-party lists – These are often a compliance headache. In many cases, you cannot rely on them for lawful email or SMS marketing.
Legitimate interests may be available for some B2B marketing, but this must be assessed carefully and supported by clear opt-out mechanisms. The ICO’s guidance on direct marketing explains where this may apply and where consent is still required.
Cookies and similar tracking technologies are also covered by PECR. In most cases, non-essential cookies require clear consent, supported by an appropriate cookie notice and preference controls.
Practical tip. Treat marketing compliance as part of your growth strategy rather than a last-minute add-on. Getting it right from day one protects your brand, builds trust with your audience and avoids costly mistakes later.
If marketing is a key lever for your business, this is one area where investing time upfront pays off. Clear consent, transparent messaging and respectful communication tend to perform better commercially as well as legally.
Step 10: Breach Readiness (Because “We’ll Deal With It If It Happens” Is Not a Plan)
A personal data breach is not limited to major cyber attacks or high-profile hacks. For small businesses, breaches are often far more ordinary and far more common than expected.
Examples of personal data breaches include:
- A hacked or compromised email account
- Sending an email or attachment to the wrong recipient
- A lost or stolen laptop, phone or USB device
- Unauthorised access to a system or shared drive
- An exposed database or misconfigured cloud storage
UK GDPR expects organisations to be able to recognise, respond to and manage personal data breaches quickly and effectively. Waiting until a breach occurs to work out what to do often leads to delays, mistakes and unnecessary risk.
A sensible approach for small businesses is to create a simple, one-page breach response playbook. This does not need to be complex or technical, but it should be clear and actionable.
Your breach playbook should cover:
- Contain the issue immediately – Secure accounts, lock compromised systems, rotate passwords, revoke access and isolate affected devices where necessary.
- Assess the risk to individuals – Consider the type of data involved, how many people are affected, and the potential harm, such as financial loss, identity theft or distress.
- Document what happened – Record the facts, the timeline, the data involved and the actions taken to contain and remediate the incident.
- Decide on notification requirements – Determine whether the breach needs to be reported to the ICO and whether affected individuals must be informed.
If a breach is likely to result in a risk to the rights and freedoms of individuals, you must normally notify the ICO within 72 hours of becoming aware of it. The ICO provides guidance and reporting tools on its personal data breach reporting page.
Even if a breach does not meet the threshold for reporting, you are still expected to keep an internal record of it. This internal breach log supports the accountability principle and demonstrates that incidents are taken seriously and handled responsibly.
Practical tip. Make sure everyone in your business knows how to spot a potential breach and who to report it to internally. Early detection and fast containment can significantly reduce harm.
Breach readiness is not about expecting the worst. It is about being prepared. A simple plan, written in advance, can make the difference between a controlled response and a compliance nightmare.
Step 11: Do You Need to Pay the ICO Data Protection Fee?
One area that often causes confusion is the ICO data protection fee. Many small businesses in the UK are required to register with the Information Commissioner’s Office and pay an annual fee, even if they are otherwise compliant with GDPR.
This requirement is separate from GDPR itself and is based on the Data Protection (Charges and Information) Regulations. It applies to most organisations that process personal data, with only limited exemptions.
For many small businesses, the fee falls into the lowest tier, which is commonly applicable to micro-organisations and sole traders. However, eligibility depends on factors such as the number of staff, turnover and the type of data processing you carry out.
The ICO provides a clear self-assessment tool and step-by-step guidance to help you determine whether you need to register and what fee applies. You can access this via the ICO data protection fee guidance.
If you are unsure, do not guess. The ICO’s checker walks you through a short set of questions and gives a clear outcome based on your answers.
Failing to pay the correct fee when required can result in enforcement action and financial penalties, even if your wider GDPR compliance is otherwise in good shape.
Practical tip. If your business changes, for example you grow your team, expand services or process new types of data, revisit the fee assessment. What applies today may not apply forever.
Registering and paying the correct ICO fee is a relatively quick task, but it is an important one. Once done, it removes a common compliance risk and shows that your business takes its data protection obligations seriously.
Step 12: Use the ICO’s Small Business Tools (They Are Genuinely Helpful)
If you want a clear, guided way to sense-check your GDPR compliance without wading through legislation, the ICO’s small business tools are one of the best resources available in the UK.
The ICO has created dedicated self-assessment checklists and practical tools specifically for small organisations and sole traders. These are designed to help you understand what applies to your business and what to focus on next.
You can access these tools via the ICO SME Hub, which acts as a central starting point for small business guidance.
These tools are particularly useful for:
- Spotting gaps quickly – They highlight areas you may not have considered, such as contracts, retention or staff awareness.
- Prioritising actions – Not everything needs to be done at once. The checklists help you focus on what matters most first.
- Demonstrating accountability – Completing and keeping these assessments shows that you have taken data protection seriously and acted deliberately.
The outputs from these tools can be saved and kept as part of your internal GDPR records. This is particularly helpful if you are ever asked by the ICO how you approach compliance or if you want to reassure partners, clients or suppliers.
Practical tip. Revisit the ICO tools periodically, especially if your business changes, such as introducing new services, new technology or new marketing channels.
Used properly, the ICO’s small business resources turn GDPR from a vague obligation into a manageable, step-by-step process. They are not just educational. They are practical tools that support real-world compliance.
A Simple GDPR Compliance Checklist for Small Businesses
If GDPR still feels overwhelming, this checklist is designed to cut through the noise. You do not need complex systems or lengthy policies to get the fundamentals right. If you can confidently tick off the items below, you are in a strong compliance position for a small business.
As a minimum, aim to have the following in place:
- A basic data map – A clear overview of what personal data you collect, where it comes from, where it is stored, why you need it and who you share it with.
- Lawful bases recorded for key processing activities – Each main use of personal data should have an identified and documented lawful basis, in line with ICO guidance.
- A published privacy notice – A clear, readable privacy notice that is easy to find and linked wherever personal data is collected.
- Contracts or DPA terms with key suppliers – Data protection clauses in place with processors such as email platforms, CRMs, payroll providers, hosting and IT support.
- Simple retention rules – Defined retention periods or criteria for different types of data, even if they are high-level and pragmatic.
- Security essentials – Core protections such as multi-factor authentication, device encryption, backups, regular updates and controlled access.
- A process for handling data subject requests – A consistent approach to receiving, logging and responding to rights requests within required timeframes.
- A breach response plan and internal log – A simple plan for managing personal data breaches and a record of incidents, even when they are not reportable.
The ICO’s guidance reinforces that GDPR compliance is about being deliberate, proportionate and accountable, not about perfection. If these foundations are in place and kept under review, most small businesses are well aligned with regulatory expectations.
Practical tip. Keep this checklist somewhere visible and review it annually or whenever your business changes. GDPR is not a one-off exercise, but maintaining these basics makes ongoing compliance far easier.
Common GDPR Mistakes Small Businesses Make (and Easy Fixes)
Most GDPR problems for small businesses are not caused by bad intentions. They usually come from assumptions, shortcuts or treating compliance as something to do once and forget about. The good news is that the most common mistakes are also some of the easiest to fix.
Using Consent When Contract or Legitimate Interests Is the Real Basis
Consent often feels like the safest option, but it is frequently the wrong one. Many businesses rely on consent when the processing is actually necessary to deliver a service or manage an existing relationship.
Fix. Decide your lawful basis purpose by purpose and document it clearly. Use contract where data is needed to provide a service, and legitimate interests where appropriate and balanced. The ICO’s guidance on lawful bases is a useful reference point.
No Privacy Notice (or One Copied from a US Template)
Some small businesses have no privacy notice at all, while others copy a generic template that does not reflect UK law or how their business actually operates.
Fix. Write a UK-specific privacy notice in plain English that matches your real data practices. Keep it readable and update it when things change. The ICO provides clear examples of what a good notice should include.
Keeping Old Leads Forever in a CRM
Holding on to historic leads “just in case” is a common habit, but it increases risk and rarely adds real value.
Fix. Set clear retention periods for enquiries and leads, and use automation where possible to delete or anonymise records once they are no longer needed.
Ignoring Supplier Risk (Especially IT Support with Full Access)
Third-party access is often overlooked, particularly where long-standing IT providers or contractors have broad system access.
Fix. Limit access to what is genuinely required, keep a documented supplier list, and make sure appropriate data protection terms are in place.
Treating GDPR as a One-Off Task
GDPR compliance is not something you complete once and never revisit. New tools, new marketing campaigns and new processes all affect how personal data is handled.
Fix. Build GDPR into your routine. A short quarterly check is often enough. Review new software, new forms, new suppliers and new marketing activity to ensure they still align with your data protection approach.
By addressing these common pitfalls, most small businesses can significantly improve their compliance without adding unnecessary complexity. Small, deliberate improvements made regularly are far more effective than one large, forgotten exercise.
Keep an Eye on Guidance Updates
Data protection is not static. The ICO has confirmed that some of its guidance is under review following the Data (Use and Access) Act coming into force in June 2025.
While the core principles of UK GDPR remain the same, wording, emphasis and practical expectations can evolve. This is especially relevant when you are updating policies, introducing new tools, or changing how you collect or use personal data.
Practical tip. When reviewing or refreshing your GDPR documents, always check the latest ICO guidance rather than relying on saved PDFs or older blog posts. This helps ensure your approach reflects current regulatory expectations.
Recommended UK-First Resources
If you want reliable, authoritative sources to refer back to, these UK-first resources are well worth bookmarking:
Using up-to-date, UK-specific sources not only improves compliance but also strengthens trust with customers, partners and regulators. When in doubt, the ICO remains the best place to sense-check what good looks like in practice.
Final Thoughts: GDPR Without the Headache
GDPR does not need to be a source of stress for small businesses. At its core, it is about understanding what personal data you hold, treating it with respect, and being open and sensible about how you use it.
If you approach compliance as a set of practical habits rather than a legal exercise, it quickly becomes more manageable. Knowing your data, choosing the right lawful bases, being transparent with customers, keeping information secure and reviewing things regularly will take you a long way.
You do not need to be perfect. The ICO’s focus is on whether you have thought about data protection, taken reasonable steps, and can show that you act responsibly. For most small businesses, that means having the basics in place and keeping them under review as the business evolves.
GDPR is also not just about avoiding fines. Done well, it builds trust with customers, strengthens your reputation and supports healthier, more professional business practices. Clear communication and good data hygiene often improve marketing, customer relationships and internal processes at the same time.
If you are unsure where to start, use the checklist in this guide and the ICO’s small business tools as your roadmap. Tackle one step at a time, document your decisions, and revisit your approach periodically. Consistent, thoughtful progress will always beat a rushed compliance scramble.
Handled properly, GDPR becomes less of a burden and more of a framework for running your business responsibly in a data-driven world.
