UK GDPR small business checklist: Practical compliance guide

26 October 2026

Opening paragraphs

UK GDPR small business checklist — whether you run a two-person consultancy or a growing limited company, handling personal data carries legal responsibilities. This practical checklist sets out clear, prioritised actions you can take today to improve data protection compliance and reduce risk.

Read on for an actionable plan covering data mapping, lawful bases, privacy notice small business essentials, ICO registration and breach response.

Why UK GDPR matters for small businesses

UK GDPR sets rules for how organisations process personal data. Compliance protects your customers and staff, reduces the chance of costly fines and reputational damage, and helps you build trust.

Small businesses are not exempt. The ICO looks at the nature and scale of processing when assessing compliance. Practical, proportionate controls will usually satisfy regulators and customers alike.

Quick checklist overview – priorities for the first 30, 60 and 90 days

First 30 days – immediate, high-impact actions

Identify obvious risks and assign responsibility for data protection to a named person.
Check whether you need to register with the ICO and start the process if required.
Publish a simple privacy notice small business customers can understand.
Ensure staff can report data incidents and know who to contact.

30–60 days – documentation and controls

Complete a basic data map of what personal data you hold, where it is stored and why you need it.
Confirm lawful bases for processing customer, supplier and employee data.
Review third-party suppliers and ensure contracts include required data protection clauses.
Set retention periods and start applying them to email, CRM and accounting records.

60–90 days – embed and test

Provide staff training on data handling and phishing awareness.
Run a tabletop breach exercise to test your incident response plan.
Review access controls and remove unused accounts.
Implement or review encryption for devices and backups.

Data mapping – the foundation of compliance

A clear data map shows what personal data you collect, process and share. It supports decisions on lawful basis, retention and security.

List categories of personal data you hold – for example, customer contact details, payment information, staff HR records.
Note where each category is stored – e-mail, cloud CRM, paper files, accounting software.
Record why you process each category and the lawful basis – for example, contract, legal obligation, legitimate interests or consent.
Identify recipients and international transfers – include processors such as payroll providers or cloud hosts.

A lightweight spreadsheet is fine for most small firms. The goal is clarity rather than perfection.

Lawful bases and consent – know when consent is required

You must identify a lawful basis for each processing activity. Common bases for small businesses include:

Contract – processing required to perform a contract with a customer or supplier.
Legal obligation – for example, payroll data processed to comply with tax and employment law.
Legitimate interests – a flexible basis, but you must carry out and document a balancing test.
Consent – necessary where you rely on voluntary, informed agreement, such as marketing messages where no other lawful basis is appropriate.

Consent must be freely given, specific, informed and unambiguous. Avoid pre-ticked boxes or bundling consent with other terms.

Privacy notice small business essentials

Your privacy notice explains how you collect and use personal data. Make it concise, readable and easy to find.

Include the following minimum information:

Who you are – business name and contact details for data protection queries.
What data you collect – categories of personal data.
Purposes and lawful bases – why you process data and on which legal basis.
Recipients – third parties you share data with, such as payroll processors or accountants.
Retention periods – how long you keep different categories of data.
Data subject rights – access, rectification, erasure, restriction, objection and portability.
Right to complain – how to contact the ICO.

Keep a short summary for customers with a link to the full policy. If you provide services likely to be accessed by children, see the GOV.UK guidance on child online safety and privacy for additional steps: https://www.gov.uk/guidance/child-online-safety-data-protection-and-privacy

ICO registration and fees – do you need to pay?

Many small organisations must pay a data protection fee to the ICO. Whether you need to pay depends on the type of data you process and your processing activities.

Check the ICO website for the latest guidance and to confirm whether your business must register: https://ico.org.uk/for-organisations/register/
Make sure the person completing the registration understands the scope of your processing and the correct fee band.
Keep proof of registration and renewal dates in your compliance records.

Failure to register when required can lead to penalties. Registration also helps demonstrate a commitment to compliance to customers and partners.

Data security – practical measures you can apply now

Security should be proportionate to the risk. For most small businesses, sensible steps significantly reduce the chance of a breach.

Use strong, unique passwords and enable multi-factor authentication on business accounts.
Encrypt devices and backups where sensitive data is stored.
Keep software and operating systems updated with security patches.
Use role-based access control – grant the minimum level of access required.
Secure physical records – lock filing cabinets and control office access.
Regularly review accounts and remove access for leavers.

If you use online HMRC services for payroll, tax or VAT, ensure only authorised staff have access and use the official GOV.UK sign-in process: https://www.gov.uk/log-in-register-hmrc-online-services

Working with processors and vendors

When a third party processes data on your behalf, you remain responsible for that processing. Contracts are crucial.

Maintain an up-to-date list of processors (payroll providers, cloud suppliers, accountants).
Use written contracts that set out the processor’s responsibilities and security measures.
Ask for and retain evidence of a processor’s security controls and certifications where appropriate.
Review contracts at onboarding and periodically thereafter.

Processors must only act on your documented instructions and must assist with data subject requests and breach notifications.

Data subject rights – how to respond to requests

Individuals have several rights under UK GDPR. Small businesses should be ready to respond within statutory timeframes.

Right of access – provide a copy of personal data you hold about the individual.
Right to rectification – correct inaccurate or incomplete data.
Right to erasure – delete data where there is no lawful basis to retain it.
Right to restriction or objection – pause or stop certain processing activities.
Right to portability – provide data in a structured, commonly used format where applicable.

Establish a process to log, verify and respond to requests promptly. If you receive a subject access request, do not ignore it – seek support from your accountant or legal adviser if unsure.

Data breaches – preparation and response

Breaches happen. What matters is how quickly and effectively you respond.

Create a simple incident response plan that includes roles, a notification timeline and communications templates.
Log all incidents, even minor ones.
Notify the ICO within 72 hours of becoming aware of a breach where there is likely to be a risk to people’s rights and freedoms.
If the breach is likely to result in a high risk to people’s rights and freedoms, inform the affected individuals without undue delay.
Use encrypting tools and access controls to reduce the impact of lost or stolen devices.

Run tabletop exercises to make sure staff know how to act and who to call.

Special considerations – employees, payroll and financial data

Employee data and payroll records contain sensitive information. Treat these categories with extra care.

Limit access to payroll and HR systems to authorised personnel only.
Review payroll processes with your payroll provider and ensure data-processing agreements are in place.
Keep historic payroll and employee records only as long as required by law and legitimate business needs.
Train line managers on confidentiality and on reporting potential breaches.

If you use external payroll or bookkeeping services, ensure contracts cover data protection and security. See our services on Payroll & PAYE and Bookkeeping & Xero for help integrating privacy with financial operations.

Children and online services – take extra care

If your product or website is likely to be used by children, you must consider additional protections. Follow the GOV.UK guidance on child online safety and data protection requirements: https://www.gov.uk/guidance/child-online-safety-data-protection-and-privacy

Avoid collecting more data than necessary from children.
Make privacy notices easy to understand for the intended age group.
Obtain parental consent where required and verify it in a proportionate way.

Record-keeping and documentation – evidence of compliance

Good records show you have thought about and acted on risks. They are practical defences if challenged.

Keep records of your data map, lawful-basis decisions and DPIAs where required.
Maintain logs of training, data subject requests and breach records.
Document contracts with processors and periodic reviews.

A compact compliance file kept digitally with version control is usually sufficient for small businesses.

Data protection impact assessments – when to carry one out

Carry out a DPIA when your processing is likely to result in high risk to individuals. Typical triggers include:

Systematic monitoring of large numbers of people.
Processing special categories of data or criminal offence data on a large scale.
Using new technologies or large-scale profiling.

For many small businesses, DPIAs are rare. When required, document the assessment, the risks identified and the mitigation steps taken.

Training and culture – creating sustainable compliance

Policies are only effective when people follow them. Build a culture where data protection is part of everyday business.

Provide role-appropriate training for staff on data handling and security.
Include data protection in new starter checklists and handbooks.
Encourage a speak-up culture for reporting concerns or incidents.
Regularly refresh training and share real examples to keep awareness high.

If you need strategic support to embed controls and reporting, consider outsourced expertise such as our Fractional CFO or advisory services for governance and reporting.

International transfers – exporting data outside the UK

If you transfer personal data outside the UK, ensure appropriate safeguards are in place.

Check whether the destination country has an adequacy decision from the UK Government.
If not, use standard contractual clauses, binding corporate rules or other approved mechanisms.
Document any transfers and the safeguards used.

Practical tools and templates to get started

Basic data map template in a spreadsheet.
Short privacy notice small business template you can publish on your website.
Processor checklist and contract clause template.
Incident response checklist and notification templates.
Training slides or micro-learning modules for staff.

If you prefer hands-off support, Figures can help with policy drafting, DPIAs and staff training as part of compliance services.

UK tax and legal accuracy

This article is for informational purposes only and does not constitute professional tax or financial advice. Please speak to a qualified accountant before taking action. This article references the UK tax year 2026/27 where relevant.

Frequently asked questions

1. Do I need to register with the ICO as a small business?

Many small businesses must register with the ICO depending on the types of personal data processed and the processing activities. Check the ICO registration guidance and fee criteria on the ICO website: https://ico.org.uk/for-organisations/register/.

2. What is the difference between consent and legitimate interest?

Consent requires a clear, affirmative action from the individual and is appropriate where people must choose freely. Legitimate interest can be used when you have a genuine business reason and you balance that against individual rights. Document the choice and balancing test you used.

3. How long should I keep customer or employee records?

Retention depends on legal requirements and business needs. Keep the minimum amount necessary and document retention periods. For payroll, tax or statutory records, follow HMRC and employment law guidance and ensure secure disposal when retention periods end.

4. What should I do if I suspect a data breach?

Follow your incident response plan: contain the issue, assess the risk, record the incident, notify the ICO within 72 hours if required and inform affected individuals if there is a high risk. Keep clear records of decisions taken.

5. Can I use overseas cloud services to store UK personal data?

Yes if appropriate safeguards are in place. Check whether the destination has an adequacy decision, or use standard contractual clauses and document the transfer and security measures.

Summary and next steps

A practical UK GDPR small business checklist need not be intimidating. Start with a simple data map, publish a clear privacy notice small business customers can read, confirm your ICO registration position and adopt proportionate security measures.

If you want guided help, Figures can review your current position, provide templates and run staff training to make compliance straightforward. Book a discovery call to discuss a tailored plan: book a discovery call.

For help with payroll and employee records, see our Payroll & PAYE service. For tidy financial data and secure bookkeeping processes, visit Bookkeeping & Xero.

Get in touch to make data protection a business advantage rather than a box-ticking exercise.