GDPR

Also called UK GDPR, Data protection, Data Protection Act 2018

The law governing how you handle information about people. It applies to every business with a customer list.

What it means

UK GDPR and the Data Protection Act 2018 govern the processing of personal data — any information relating to an identified or identifiable living person.

You need a lawful basis for each processing purpose, you must tell people what you do with their data, keep it secure and no longer than necessary, and honour their rights over it.

Why it matters

It applies to businesses of every size. There is no small-business exemption, though some record-keeping obligations are lighter under 250 employees.

The rights are exercisable by anyone: a customer, an employee or a job applicant can make a subject access request, and you have a month to respond.

What it looks like in practice

The practical minimum: know what personal data you hold and why, have a privacy notice that reflects reality, set retention periods and actually delete, secure the data proportionately, and have a process for subject access requests and breaches.

Register with the ICO and pay the data protection fee — it is a legal requirement for most organisations and the fee is small.

A personal data breach that risks people's rights must be reported to the ICO within 72 hours of becoming aware of it.

What to watch out for

Consent used as the lawful basis where legitimate interests or contract would be more appropriate. Consent must be freely given and withdrawable, which makes it fragile for things you need to do anyway.

Marketing rules are separate and stricter — see email marketing and PECR.

Suppliers who process data for you need a written data processing agreement.

Where to get proper advice

The ICO's small business guidance is free, clear and written for non-specialists. It is genuinely the best starting point.