%20(4115%20x%202362%20px).png)
GDPR is a key part of the UK's framework for protecting personal data. If your business handles information about clients, customers or employees, the rules are likely to apply.
Lowdown
GDPR stands for the General Data Protection Regulation. In the UK, the main rules come from the UK GDPR and the Data Protection Act 2018, as amended by later legislation, including the Data (Use and Access) Act 2025. Personal data means information relating to an identified or identifiable living person.[1]
Why It Matters
Businesses of every size can be covered when they process personal data. You need a lawful basis, meaning a valid legal reason, for using it. Consent is one option, but others include contract and legitimate interests. The appropriate basis depends on why you use the data.[2]
You should tell people how you use their data, keep it secure and retain it only as long as necessary. You must also respect rights such as access, correction and, in some circumstances, deletion.[2]
If a supplier processes personal data on your behalf, a written contract containing required data protection terms is normally necessary. Sharing data with another organisation that independently decides why and how to use it is different. A data sharing agreement can be good practice, but it is not the same as a processor contract.[3]
The Information Commissioner's Office can investigate breaches and take enforcement action, including financial penalties. Penalties depend on the circumstances and must be proportionate.[4]
Our Conclusion
Know what personal data you hold, why you use it, who receives it and how you protect it. Small businesses are not exempt simply because they are small.
Sources
[1] GOV.UK, The UK's data protection legislation and ICO, Data (Use and Access) Act 2025: What does it mean for organisations?
[2] ICO, Assessment for small business owners and sole traders and A guide to lawful basis
[3] ICO, Contracts and liabilities between controllers and processors