Why data protection matters to a small firm

If you hold a customer's name and address, an employee's payroll details, or a supplier's contact list, you are handling personal data — and the UK GDPR and the Data Protection Act 2018 apply to you just as much as they do to a large organisation. That can sound daunting when you are already juggling cash flow, staffing and sales. The reassuring part is that the law expects measures that are proportionate to the size of your business and the data you handle. A five-person joinery firm does not need the same machinery as a bank.

In practice, most complaints and breaches we see in small firms start with something mundane: an email sent to the wrong recipient, a laptop left on a train, a shared spreadsheet of customer details that nobody has updated in three years. Getting the basics right removes most of your risk, and it usually makes your admin easier too.

Know what you hold and why you hold it

You cannot protect data you have not mapped. Spend an afternoon listing what personal data your business collects, where it lives, who can see it, and how long you keep it. Include the awkward places: the enquiries inbox, the accountant's shared drive, the CRM your sales team half-uses, the paper diary on reception, the CCTV camera over the door.

For each type of data, be clear about your lawful basis for processing it. Most small firms rely on one of three:

• Contract — you need the details to deliver what the customer bought.
• Legal obligation — HMRC, payroll or insurance requirements, for example.
• Legitimate interests — reasonable business purposes such as fraud prevention, balanced against the individual's rights.

If you rely on consent, it must be a genuine opt-in with no pre-ticked boxes, and people must be able to withdraw it easily. Whatever your basis, your privacy notice should say plainly what you collect, why, who you share it with and how long you keep it. Write it in plain English, not copy-pasted legal fog nobody reads.

Keep records accurate, relevant and tidy

Data protection is not only about secrecy; it is also about accuracy. If a customer tells you their details have changed, update them. If someone asks what you hold about them — a subject access request — you generally have one month to respond, and you should have a clear process for finding it. Keep a simple log of requests so nothing goes missing when the person who took the call is on holiday.

The other half of tidiness is deletion. Set a retention period for each category and stick to it:

• Unsuccessful job applications: keep for around six months, then shred or delete.
• Customer records: keep for as long as the relationship lasts, plus any period your insurer or accountant requires.
• CCTV footage: usually no more than 30 days unless you need it for an investigation.
• Marketing lists: remove people who have not engaged in a reasonable period and honour opt-outs promptly.

Old data is a liability, not an asset. If you cannot explain why you are still holding something, you probably should not be.

Secure the devices, files and accounts you already use

You do not need an enterprise security budget, but you do need the fundamentals:

• Turn on automatic updates for laptops, phones and any software you use.
• Use unique passwords with multi-factor authentication, particularly for email and cloud accounts. Email is the keys to the kingdom.
• Encrypt laptops and mobiles and set screens to lock after a few minutes. If a device is lost or stolen, encryption is what stops a bad day becoming a reportable breach.
• Back up important data and test that you can restore it. A backup you have never tried to use is a hope, not a plan.
• Control access. Give people only the data they need, and remove access the same day someone leaves.
• Mind the paperwork. Lock cabinets, avoid leaving printouts by the printer, and be careful with home working.

Send sensitive documents by a secure method rather than a plain attachment, and check the recipient's email address before you hit send. That single habit prevents a surprising number of incidents.

Train your team and make reporting easy

Your people are your best defence and your most common accident. Short, regular briefings beat a thick policy document nobody opens. Cover how to spot a phishing email, why customer details should not be copied into personal spreadsheets, and who to tell if something goes wrong.

Create a no-blame reporting culture. If a member of staff forwards a file to the wrong person, you want to hear about it within minutes, not weeks. Under UK GDPR, a personal data breach that risks people's rights must be reported to the Information Commissioner's Office within 72 hours of you becoming aware of it — and you must keep an internal record of every breach, even those you do not report. Nominate one person as your data protection lead, keep a simple breach log, and make sure everyone knows their name.

A workable routine for a small team

Start with a short, honest audit and a list of fixes you can complete this quarter. Many firms also need to pay the annual data protection fee to the ICO, typically £40 or £60 depending on size, unless an exemption applies. Then build a simple rhythm:

• Review your data inventory and privacy notice once a year.
• Check retention and delete what has expired.
• Confirm updates, backups and access rights are still in order.
• Run a 20-minute refresher with staff, and revisit it when you adopt new software or take on seasonal workers.

Small, consistent steps will serve you far better than a perfect policy written once and forgotten. And if you are ever unsure whether an incident is reportable, seek advice promptly — acting early is nearly always viewed more kindly than acting late.