Personal data law: what a small business actually has to do

The common assumption is that this legislation applies only to large organisations. It does not. Any business holding a name, phone number or address is within scope — including its own employees' records and the footage from cameras on the premises.

The other misconception is that consent is needed from everyone for everything. It is not. The law provides other bases: performance of a contract, compliance with law, and legitimate interest. Taking consent where another basis applies is actually a disadvantage, because consent can be withdrawn at any time.

What a small business needs is therefore not a stack of documents, but knowing what it holds, where, why, and who can reach it.

What should a small business do first?

• List whose data you hold — customers, employees, job applicants, suppliers, visitors — and where each is kept.
• State why each item is held, and delete what has no reason to be there. Data you do not hold cannot leak.
• Write a privacy notice that describes what actually happens, not one copied from elsewhere.
• Limit access to those who need it, and change shared passwords.
• Put agreements in place with outside processors: bookkeepers, IT support, cloud providers.
• Sign the areas covered by CCTV and set a retention period for the footage.

What happens when someone exercises their rights?

• To be told what you hold about them, and to receive a copy.
• To have inaccurate data corrected.
• To have data deleted when it is no longer needed, or to withdraw consent.
• To object to use for marketing.
• To complain to the regulator if a request is not acted on.

You need a channel for these requests and must respond within the period allowed. Most businesses use a central email address — which someone has to actually monitor.

Data has leaked: who do you tell, and how fast?

In small businesses this is usually an email sent to the wrong person, lost paperwork containing customer details, or a ransomware incident. The law requires notification to the regulator without delay and within seventy-two hours of becoming aware, and notification to the individuals where the risk to them is high.

That period is far too short to start reading up once it has happened. Decide in advance who is told and who decides.

What do businesses commonly overdo?

• Taking consent where another basis already applies — employee records held to perform the employment contract and comply with labour law, for example.
• Producing a great deal of documentation without changing how anything is actually done, which reduces neither risk nor exposure.
• Keeping copies of ID cards in every case, without a reason to.

This page is general information, not advice on your business. What is required depends on the data held and the nature of the business. Tell us the details and what is genuinely needed can be assessed.