A Plain-English GDPR Guide for Small Businesses

GDPR (the UK General Data Protection Regulation, the UK's version following Brexit, alongside the Data Protection Act 2018) tends to get treated by small businesses in one of two ways: either as something that only really applies to big companies, or as an intimidatingly complicated legal minefield best avoided entirely. Neither view is particularly accurate, and the practical basics are more manageable than they're often made out to be. This is general information, not legal advice — for anything specific to your business, it's worth checking with a qualified advisor or the Information Commissioner's Office directly.

Who it actually applies to

If your business holds any personal data at all — customer names and contact details, employee records, even a basic CRM or mailing list — GDPR applies to you. Size genuinely isn't the deciding factor; what matters is that personal data is being collected and processed, which describes the vast majority of small businesses whether they've thought about it in those terms or not.

The core principles, in plain terms

Collect only the personal data you genuinely need for a clear purpose, don't use it for something unrelated to why it was collected, keep it reasonably secure, don't hold onto it indefinitely once it's no longer needed, and be able to explain clearly to someone what data you hold about them and why, if they ask. Most of this is close to what a sensibly-run business would want to do anyway, regulation aside.

Practical things worth actually having in place

• A privacy policy on your website that honestly describes what data you collect and why.
• Some reasonable idea of what personal data you hold, where it's stored, and who can access it.
• A basic process for someone's data to be deleted or provided to them if they formally ask for it.
• A sensible process for responding if a data breach does happen — some breaches must be reported to the ICO within 72 hours of becoming aware of them.

Where IT and GDPR genuinely overlap

A meaningful part of practical compliance is really just good security practice: controlling who has access to systems holding personal data, keeping software updated, having proper backups, and not leaving sensitive data lying around in unsecured spreadsheets or unencrypted devices. Good IT housekeeping and reasonable GDPR practice overlap more than people expect.

Don't let perfect be the enemy of reasonable

Full legal compliance is a conversation for a solicitor or dedicated data protection advisor, particularly for anything involving sensitive categories of data or unusual processing. But the baseline practical steps above are well within reach for most small businesses without needing to treat the whole subject as overwhelming.

If you'd like help reviewing the IT side of this — access controls, data security, and sensible backup practice — our cyber security page covers how we can help, or get in touch.