GDPR compliance basics for UK small businesses

For many small and medium-sized enterprise (SME) owners in the UK, the term 'GDPR' can trigger a mild sense of dread. It often conjures images of complex legal documents, hefty fines, and administrative headaches. But it doesn't have to be that way. The UK General Data Protection Regulation (UK GDPR) isn't just a regulatory burden; it's a framework for building trust with your customers and a vital component of modern cyber security. In a world where data is one of your most valuable assets, treating it with respect is simply good business. This guide will demystify UK GDPR, breaking it down into manageable, practical steps that you can implement to protect your business, your customers, and your reputation.

Understanding Your Data: The Foundation of Compliance

Before you can protect data, you need to know what data you have, why you have it, and where it lives. This is the absolute first step, and skipping it is like trying to build a house without foundations. The process of mapping out your data is often called a "data audit" or "data mapping exercise."

What Counts as "Personal Data"?

Under UK GDPR, personal data is any information that can be used to identify a living person. This is broader than many people think. It includes the obvious, but also the less obvious:

• Direct Identifiers: Name, address, email address, phone number.
• Official Identifiers: National Insurance number, passport number.
• Online Identifiers: IP addresses, cookie identifiers.
• HR Data: Employee records, payroll information, sickness records.
• Visual and Audio Data: CCTV footage, recorded phone calls.
• Location Data: GPS tracking information from company vehicles or devices.

There is also a "special category" of data which is more sensitive and requires extra protection. This includes information about an individual's race or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, and health data.

How to Conduct a Data Audit

The goal is to create a record of your processing activities. This doesn't need to be a complex piece of software; for most SMEs, a well-organised spreadsheet is a perfect starting point. Your audit should answer the following questions for each type of personal data you handle:

1. What? What specific type of personal data are you collecting? (e.g., Customer email addresses, employee bank details).
2. Why? What is your purpose for processing this data? (e.g., To send a marketing newsletter, to pay staff salaries).
3. Who? Who has access to this data, both internally and externally? (e.g., Marketing team, HR department, third-party payroll provider).
4. Where? Where is the data stored? (e.g., On-site server, in a cloud service like Microsoft 365, on employee laptops, in a physical filing cabinet).
5. How long? How long do you need to keep it for? (e.g., For the duration of the client relationship, for 6 years after an employee leaves as required by law).
6. How? How is it secured? (e.g., Encrypted, password-protected, behind a firewall).

Completing this exercise gives you a clear map of your data landscape. It forms the basis for your privacy policy, helps you identify security risks, and makes it much easier to respond if someone asks to see the data you hold on them.

The 7 Core Principles of UK GDPR

UK GDPR is built around seven key principles. Think of these as the fundamental rules for handling personal data. If your data processing activities align with these principles, you're well on your way to compliance.

1. Lawfulness, fairness and transparency: You must have a legitimate reason for processing data, you must not use it in a way that is unduly detrimental or misleading, and you must be clear and open with people about how you use their data. This is often achieved through a clear, easy-to-read privacy notice.

2. Purpose limitation: You should only collect data for a specific, explicit, and legitimate purpose. You cannot collect data for one reason (e.g., to process an order) and then decide to use it for a completely different, incompatible purpose (e.g., selling it to a third party) without getting fresh consent.

3. Data minimisation: You should only collect and process the personal data that is absolutely necessary to achieve your purpose. If you only need an email address to send a newsletter, don't ask for a home address and date of birth as well.

4. Accuracy: You must take reasonable steps to ensure the personal data you hold is accurate and kept up to date. If you know information is incorrect, you should correct it.

5. Storage limitation: You should not keep personal data for longer than is necessary for the purpose you collected it for. This is why defining retention periods in your data audit is so important. Hoarding data "just in case" is a compliance risk.

6. Integrity and confidentiality (Security): This is a critical principle for any IT provider. You must ensure you have appropriate technical and organisational security measures in place to protect personal data from unauthorised or unlawful processing, accidental loss, destruction, or damage. This is where cyber security best practices are essential.

7. Accountability: You are responsible for complying with these principles and must be able to demonstrate your compliance. This means keeping records of your processing activities (like your data audit), having clear policies, and training your staff.

Establishing a Lawful Basis for Processing

You cannot process personal data unless you have a valid reason, known as a "lawful basis." There are six lawful bases available, but for most SMEs, three are particularly relevant:

1. Consent

This is when an individual gives you clear, affirmative permission to process their data for a specific purpose. For consent to be valid, it must be:

• Freely given: The person must have a genuine choice.
• Specific and informed: You must explain exactly what they are consenting to.
• Unambiguous: It must be a clear positive action, like ticking a box. Pre-ticked boxes are not valid consent.

Example: A checkbox on your website that says, "I would like to receive marketing emails about new products and offers."

2. Contract

You can process personal data if it is necessary to fulfil a contract you have with an individual, or because they have asked you to take specific steps before entering into a contract.

Example: You need to collect a customer's address and payment details to process an online order and deliver the goods they have purchased. You don't need separate consent for this.

3. Legitimate Interests

This is the most flexible lawful basis, but it comes with extra responsibility. You can process data if it's necessary for your legitimate interests (or the interests of a third party), as long as those interests are not overridden by the rights and freedoms of the individual. You must perform a simple three-part test:

• Purpose Test: Are you pursuing a legitimate interest?
• Necessity Test: Is this processing necessary to achieve that purpose?
• Balancing Test: Do the individual's interests, rights, and freedoms override your legitimate interest?

Example: Using customer purchase history to provide personalised product recommendations on your website to improve their experience and increase sales.

Practical Cyber Security Measures for GDPR

The "integrity and confidentiality" principle means that data protection and cyber security are two sides of the same coin. The Information Commissioner's Office (ICO), the UK's data protection regulator, expects you to have robust security measures in place. A great framework to follow is the government-backed Cyber Essentials scheme, which covers the fundamentals of cyber hygiene.

Essential Technical Controls

• Multi-Factor Authentication (MFA): This is arguably the single most effective security control you can implement. It requires users to provide two or more verification factors to gain access to a resource, dramatically reducing the risk of unauthorised access to accounts holding personal data.
• Strong Password Policies: Enforce the use of long, complex passwords and, ideally, provide staff with a password manager to securely store them.
• Encryption: Data should be encrypted both "at rest" (when stored on laptops, servers, or in the cloud) and "in transit" (when sent over the internet, like via email). This makes the data unreadable if it's intercepted or a device is stolen.
• Regular Patching and Updates: Software vulnerabilities are a primary entry point for attackers. Ensure that your operating systems, applications (like Microsoft Office), and security software are always kept up to date.
• Firewalls and Antivirus: These are the foundational gatekeepers for your network and devices, helping to block malicious traffic and detect malware before it can cause damage.

Essential Organisational Controls

• Access Control: Implement the "principle of least privilege." Staff should only have access to the data and systems they absolutely need to perform their jobs. An employee in marketing does not need access to HR records.
• Staff Training: Your employees are your first and last line of defence. Regular training on data protection responsibilities, identifying phishing emails, and secure data handling is not a "nice-to-have"—it's a necessity.
• Clear Policies: Have a written Data Protection Policy, an Acceptable Use Policy for IT equipment, and a clear process for staff to follow when handling data.

Responding to Requests and Breaches

Being compliant isn't just about preventing problems; it's also about knowing how to react when they occur.

Handling Subject Access Requests (SARs)

Individuals have the right to request a copy of the personal data you hold on them. This is known as a Subject Access Request, or SAR. When you receive one, you must:

• Respond without undue delay, and at the latest within one month.
• Provide the information free of charge in most cases.
• Have a process to find, review, and supply the requested information securely.

Your data audit is invaluable here, as it tells you exactly where to look for the person's data.

Managing a Data Breach

A personal data breach is a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This isn't just about being hacked; it also includes sending an email with personal data to the wrong recipient or losing an unencrypted laptop.

If a breach occurs, you need to assess the risk. If the breach is likely to result in a risk to the rights and freedoms of individuals, you must report it to the ICO within 72 hours of becoming aware of it. This is a strict deadline, which is why having a pre-prepared Incident Response Plan is crucial.

Key Takeaways

GDPR compliance is an ongoing journey, not a one-time project. For UK SMEs, focusing on the basics provides a strong and defensible position.

• Know Your Data: You cannot protect what you do not know you have. A thorough data audit is your first and most important step.
• Follow the Principles: The seven core principles are your rulebook. Use them to guide all your data handling activities.
• Justify Your Processing: Ensure you have a valid lawful basis for every type of data processing you do.
• Security is Non-Negotiable: Implement fundamental cyber security controls. The Cyber Essentials framework is an excellent benchmark.
• Be Prepared: Have clear, simple processes for handling Subject Access Requests and for responding to a data breach.
• Document Everything: The accountability principle requires you to be able to demonstrate your compliance. Keep records of your decisions, policies, and training.

To take the next step

Book a Discovery Call