GDPR for Small Businesses: A Plain-English Checklist

If you take a customer's name and email, keep a list of clients, or run a website with a contact form, you are handling personal data. Data protection law applies to you, however small you are.

The good news: you do not need a law degree to get the basics right. This guide walks through what the law asks of a typical small business in England and Wales, in plain English. It is general information, not legal advice.

First, what is "GDPR" in the UK?

After Brexit, the UK has its own version, usually called the UK GDPR. It sits alongside the Data Protection Act 2018. Both are on legislation.gov.uk. The UK GDPR text is at legislation.gov.uk/eur/2016/679. The law has been amended since, including by the Data (Use and Access) Act 2025.

What counts as personal data?

Anything that identifies a living person, alone or together with other information. Examples: names, email addresses, phone numbers, home addresses, photos, online identifiers, employee records, and customer order histories.

The practical checklist

1. List what you hold.

Write down what personal data you collect, where it comes from, where it is stored, and who you share it with (your accountant, payment provider, email software, courier). A simple spreadsheet is enough to start.

2. Know why you collect it.

For each type of data, you need a lawful reason for using it. The UK GDPR lists six (for example, a contract, a legal obligation, or consent). Pick the one that genuinely fits. Do not default to "consent" for everything.

3. Collect only what you need.

If you do not need someone's date of birth to deliver your service, do not ask for it. Less data means less risk.

4. Tell people what you do with their data.

This is the part most small businesses miss. The UK GDPR requires you to give people clear information about who you are, what you collect, why, who you share it with, how long you keep it, and what rights they have. This is normally done through a privacy notice, often called a privacy policy, on your website and wherever you collect data (see Articles 13 and 14 of the UK GDPR).

5. Decide how long you keep data.

Do not keep personal data "just in case". Set a sensible period for each type, and delete or anonymise it afterwards.

6. Keep it secure.

Use strong passwords, two-step login, up-to-date devices, and limit who can see what. If you use suppliers who handle data for you (for example, a bookkeeping service or a mailing platform), check what they do with it. Where a supplier handles personal data on your behalf, the law expects a written contract with specific terms (Article 28, UK GDPR). Our Data Processing Agreement is for that situation.

7. Know people's rights.

Individuals can ask to see their data, ask for corrections, and in some cases ask for deletion or object to your use of it. Decide who in your business handles these requests and how you will recognise one. There are time limits for replying.

8. Check whether you need to pay the data protection fee.

Many organisations that process personal data must pay a yearly fee to the Information Commissioner's Office (ICO), unless an exemption applies.

9. Plan for problems.

Know what you would do if a laptop is lost or an email goes to the wrong person. Some data breaches must be reported to the ICO within a set time, and sometimes to the people affected too.

10. Use cookies and marketing emails properly.

If your website uses non-essential cookies, or you send marketing emails or texts, separate rules apply under the Privacy and Electronic Communications Regulations 2003.

Common mistakes

• Copying another company's privacy policy that describes things you do not do.
• Collecting data "in case it's useful later".
• Having no process for a customer who asks to see their data.
• Forgetting that staff and job applicants are people with data rights too.

Where a privacy policy fits in

A privacy policy is not the whole of data protection compliance. It does not replace good habits, a data register, security, or staff awareness. But it is a core piece: it is how you tell people what you do. A policy should match your real practices, so answer questions about your business honestly, then generate a draft you can review.

UKDocs AI asks you simple questions about your business and produces a Privacy Policy draft for England and Wales in minutes. Review it, make sure it reflects what you actually do, and ask a solicitor if your situation is complex.

Not sure how a privacy policy differs from your terms and conditions? Read Privacy Policy vs Terms and Conditions: What's the Difference?