For a small business, GDPR can look like a mountain of paperwork written for someone else. Long policies, registers, assessments, training logs. It is tempting to either do nothing or buy a template pack that sits in a folder.
Neither helps. The law applies whatever your size, but what it expects is proportionate. For most small businesses, getting five things right covers most of the risk.
1. Know what personal data you hold
You cannot protect what you do not know you have. List the personal data you collect about customers, staff, suppliers and website visitors: where it is kept, who can access it, who you share it with and how long you keep it.
A simple spreadsheet is a good start. Organisations with fewer than 250 employees only need formal records for some of their processing, but anything you do regularly, such as payroll or customer records, is usually included. Our data mapping service can do this with you.
2. Tell people what you do with their data
People have the right to know what you do with their personal data. That means a privacy notice on your website and, where relevant, separate notices for staff and job applicants. It should be in plain English, specific to your business, and match what you actually do. A notice copied from someone else's website rarely does.
3. Have a lawful basis for each use
Every use of personal data needs one of six lawful bases. Most small businesses rely on contract (to provide what a customer has asked for), legal obligation (such as payroll and tax records) and legitimate interests. Consent is often assumed to be needed for everything, but it is only one option, and the hardest to manage.
Marketing has its own rules. Marketing emails and texts to individuals usually need their consent. The exception is existing customers who bought something similar from you and were given a simple way to opt out, both when you collected their details and in every message.
4. Keep it secure, including with your suppliers
Security does not need to be expensive, but it does need to be deliberate:
- Multi-factor authentication on email and key systems.
- Accounts removed when people leave, and no old test or shared accounts left behind. The ICO's recent "Password1" reprimands show what happens when they are.
- Devices and software kept up to date, and data backed up.
- Access limited to the people who need it.
The government-backed Cyber Essentials scheme is a sensible baseline. And your suppliers count too: payroll, IT, cloud and marketing platforms that handle personal data for you need a written contract with the right terms. We explain why in supplier data breaches are still your problem.
5. Know what to do when something happens
Two situations catch small businesses out because they come with fixed deadlines:
- A data breach. If it is likely to put people at risk, you must report it to the ICO within 72 hours of becoming aware of it. A short plan, written in advance, of who decides and who to call makes that achievable.
- A subject access request. Anyone can ask for a copy of the personal data you hold about them, and you normally have one month to respond. Requests often arrive as an ordinary email, sometimes in the middle of a dispute. Our guide to what a subject access request requires walks through it.
Most businesses that handle personal data also need to pay the ICO's annual data protection fee, unless they are exempt. It takes a few minutes to check on the ICO website.
What you do not need
You do not need a 40-page policy nobody reads. You do not need a data protection officer unless you are a public authority, or your core business involves large-scale monitoring of people or large-scale use of sensitive data. And you do not need to do everything at once.
Know your data. Be open about it. Have a lawful basis. Keep it secure. Be ready.
Get those five right and you are in a far stronger position than most. Our GDPR support for small businesses is built around exactly these areas, or you can start with a free data protection review.
