If you run a small business, data protection can feel like one of those things you know you should understand, but keep putting off.

You might think GDPR is mainly something that applies to large companies with huge databases of customer information.

It isn’t.

If your business employs people, has customers, takes enquiries through a website, uses email marketing, processes payments or simply keeps a spreadsheet containing people’s contact details, you’re probably handling personal data.

That means data protection matters.

The good news is that small businesses don’t need a giant data protection department. But they do need to understand what information they hold, why they hold it and how they keep it secure.

What is personal data?

Personal data is broadly information relating to an identified or identifiable living person.

That can include obvious things such as:

• Name

• Home address

• Email address

• Telephone number

• Date of birth

But it can also include information such as:

• IP addresses

• Online identifiers

• Employee records

• CCTV footage

• Location information

• Customer records

• Recruitment information

• Performance records

In an SME, personal data can be everywhere.

Your CRM contains customer information.

Your payroll system contains employee information.

Your inbox contains names and email addresses.

Your website may collect information through contact forms and analytics.

Even a spreadsheet of prospective customers is likely to contain personal data.

GDPR still matters to UK businesses

The UK’s data protection framework is primarily based around the UK GDPR and the Data Protection Act 2018.

The Information Commissioner’s Office, or ICO, is the UK’s independent regulator for data protection and information rights.

The rules are designed around a number of key principles.

Personal data should be:

• Processed lawfully, fairly and transparently

• Collected for specific purposes

• Limited to what is necessary

• Accurate

• Kept only for as long as necessary

• Kept secure

There are additional requirements around accountability, meaning organisations need to be able to demonstrate that they comply with the rules.

You need a reason for processing personal data

One of the most important concepts in data protection is lawful basis.

You cannot simply collect personal information because you might find it useful one day.

You need an appropriate lawful basis for processing it.

The UK GDPR provides several lawful bases, including:

• Consent

• Contract

• Legal obligation

• Vital interests

• Public task

• Legitimate interests

The appropriate basis depends on what you’re doing with the information.

For example, an employer needs employee bank details to pay an employee. That’s very different from collecting someone’s email address because you want to send them marketing.

And consent isn’t automatically the answer.

Businesses sometimes assume that they should simply add a consent checkbox to everything.

That’s not necessarily appropriate.

The lawful basis should reflect the actual reason you’re processing the information.

What about employee data?

This is particularly important for small businesses because employers hold a significant amount of personal information about their employees.

You might hold:

• Recruitment information

• Right to work documents

• Bank details

• National Insurance information

• Emergency contacts

• Holiday records

• Sickness absence information

• Performance records

• Disciplinary records

• Training records

Some of this information can be particularly sensitive.

For example, information about an employee’s health is special category data and has additional protection under data protection law.

This is one reason why HR records should be stored securely and access should be restricted to people who genuinely need the information.

Don’t collect information just because you can

A useful question for SMEs is:

“Do we actually need this information?”

If the answer is no, consider whether you should be collecting it at all.

The principle of data minimisation means personal data should be adequate, relevant and limited to what is necessary for the purpose.

For example, if you’re collecting information from a job applicant, you should consider what information you genuinely need at that stage of the recruitment process.

The same applies to customer information.

More data isn’t automatically better.

More data can mean more responsibility.

Keep personal data secure

Data protection isn’t just about having the right policy.

You also need to think about practical security.

For a small business, that might include:

• Strong passwords

• Multi-factor authentication

• Secure cloud systems

• Access controls

• Regular software updates

• Secure disposal of documents

• Encrypted devices

• Staff training

• Backups

• Clear rules around sharing information

Think about what would happen if an employee’s laptop was stolen.

Or someone accidentally emailed a spreadsheet containing customer information to the wrong person.

Or an employee left the business but still had access to your shared drive.

These are practical data protection issues that SMEs need to consider.

What happens if there is a data breach?

A personal data breach could involve:

• Personal information being sent to the wrong person

• A lost laptop

• A hacked email account

• Ransomware

• Accidental deletion

• Unauthorised access

• A stolen device

• Paper records being lost

Not every breach has to be reported to the ICO.

The business needs to assess the risk to people’s rights and freedoms.

Where a breach is reportable, the ICO generally needs to be notified without undue delay and, where feasible, within 72 hours of becoming aware of it.

That means businesses should have some idea of what they will do if something goes wrong before it happens.

Do you need a Privacy Notice?

If you’re processing personal data, you will generally need to provide people with information about how you use it.

This is normally done through a Privacy Notice.

A privacy notice should explain things such as:

• What personal data you collect

• Why you collect it

• Your lawful basis

• Who you share it with

• How long you keep it

• People’s rights

• How they can contact you about their data

You may need different privacy information for different groups.

For example, your customer privacy notice may not be appropriate for employees.

Your recruitment privacy information may also need to address the information collected from job applicants.

What about cookies?

If you have a website, cookies and similar technologies may also need consideration.

Not all cookies are treated in exactly the same way.

Some are necessary for a website to function, while others are used for analytics, advertising or tracking.

Your website should therefore have appropriate cookie information and mechanisms where required.

This is an area where businesses often overlook the difference between simply having a privacy policy and actually complying with the rules governing cookies and electronic communications.

Do small businesses need a Data Protection Officer?

Not necessarily.

The fact that you’re a small business doesn’t automatically mean you need a Data Protection Officer.

Whether a formal DPO is required depends on the nature and scale of your processing and the activities your organisation carries out.

For most ordinary SMEs, appointing a formal DPO won’t be necessary.

However, someone should still have clear responsibility for data protection within the business.

That might be the business owner, an operations manager, HR lead or another appropriate person.

Do you need a data protection policy?

A small business should have appropriate internal arrangements for handling personal data.

That might include a data protection policy covering expectations around:

• Accessing personal information

• Storing information

• Sharing information

• Keeping information secure

• Reporting breaches

• Deleting information

• Using personal devices

• Email and communications

The exact documentation you need will depend on the size and nature of your business.

Again, there is no prize for having the biggest policy folder.

The important thing is that your policies reflect what you actually do.

Think about your suppliers

Your business may not process all personal data itself.

You might use:

• Payroll providers

• Accountants

• HR software

• CRM systems

• Email marketing platforms

• Cloud storage

• Recruitment platforms

• IT providers

Some of these organisations may process personal data on your behalf.

That means you need to understand what information you’re sharing, why you’re sharing it and what contractual arrangements are in place.

Under the UK GDPR, organisations that use processors need appropriate contractual arrangements and should take reasonable steps to ensure processors provide sufficient guarantees around data protection.

What rights do people have?

People have a range of rights under data protection law.

Depending on the circumstances, these can include the right to:

• Be informed about how their data is used

• Access their personal data

• Correct inaccurate information

• Request erasure

• Restrict processing

• Object to processing

• Data portability

• Challenge certain automated decision-making

This means a small business needs to know what to do if someone sends an email saying:

“I’d like to see all the personal information you hold about me.”

That could be a Subject Access Request, or SAR.

You don’t necessarily need a sophisticated system to deal with these requests, but you should know who is responsible for handling them and understand the applicable timescales.

Don’t forget your employees

Data protection training shouldn’t be limited to the person responsible for HR or IT.

Employees are often the people handling personal information every day.

They should understand basic expectations around:

• Email

• Passwords

• Sharing information

• Personal devices

• Confidentiality

• Phishing

• Data breaches

• Customer information

• Employee information

A sophisticated cybersecurity system won’t help much if someone emails an entire employee spreadsheet to the wrong person.

A simple data protection health check for SMEs

If you’re a small business, ask yourself:

Do we know what personal data we hold?

Do we know why we’re collecting it?

Do we have an appropriate lawful basis?

Do people know how we’re using their information?

Is access restricted to people who need it?

Are our systems and devices appropriately secure?

Do we know what to do if there’s a data breach?

Do we have appropriate privacy information?

Do we know how to respond to a Subject Access Request?

Do we understand what information our suppliers process for us?

Do our employees understand their responsibilities?

If you can’t answer some of these questions, that doesn’t necessarily mean your business is doing everything wrong.

It means you’ve found an area worth reviewing.

The FoundrKit view

Data protection can feel unnecessarily complicated when you’re running a small business.

But the fundamentals are actually quite straightforward.

Know what information you have.

Know why you have it.

Only collect what you need.

Keep it secure.

Tell people what you’re doing with it.

Have a plan for when something goes wrong.

And remember that your data protection arrangements should grow with your business.

A five-person consultancy probably doesn’t need the same infrastructure as a 500-person organisation.

But it still needs to take people’s personal information seriously.

Good data protection isn’t about creating endless paperwork.

It’s about building sensible habits into the way your business operates.

Need to review your HR foundations?

FoundrKit provides practical HR documents and guidance for startups and small businesses, helping you build the foundations you need without unnecessary complexity.

One purchase. Clear pricing. No subscription.