If you collect names, emails or customer details, UK data protection law applies to you, even if you are a one-person business. This guide gives a plain-English overview and practical steps. It is general information, not legal advice, so check the ICO website for your situation.
What counts as personal data?
Any information that can identify a living person: names, email addresses, phone numbers, addresses, IP addresses and online identifiers. Your customer list, contact form submissions and email newsletter subscribers all count.
The basic principles
- Use data lawfully, fairly and transparently.
- Collect only what you need, for a clear purpose.
- Keep it accurate and up to date.
- Do not keep it longer than necessary.
- Keep it secure.
Do you need to register with the ICO?
Many organisations that process personal data must pay a data protection fee to the Information Commissioner’s Office (ICO), unless an exemption applies. The ICO has a short self-assessment on its website, so check there rather than guessing.
Practical steps for a small business
- Know what you hold. List where customer data lives: email, accounting, CRM, forms and spreadsheets.
- Publish a privacy notice. Say what you collect, why, who you share it with and how people can contact you.
- Get consent for marketing. Use clear opt-in and make unsubscribing easy.
- Secure your accounts. Use MFA, strong passwords and device encryption. See our cyber security checklist.
- Check your suppliers. Use reputable providers and review how they handle data.
- Have a breach plan. Serious breaches must be reported to the ICO within 72 hours.
Cookies and website tracking
If your website uses analytics or advertising cookies that are not strictly necessary, you generally need to tell visitors and ask for consent. Use a cookie banner that lets people reject non-essential cookies.
People’s rights
Individuals can ask to see their data, correct it or ask you to delete it. Be ready to respond, normally within one month.
Frequently asked questions
Does UK GDPR apply after Brexit?
Yes. The UK has its own version, alongside the Data Protection Act 2018.
Do I need a Data Protection Officer?
Most small businesses do not. The rules apply to certain large-scale or high-risk processing.
Where can I get official guidance?
The ICO website has free guides and templates for small organisations.
