Know the data
Identify the personal information collected across customers, staff, suppliers and prospects.
GDPR for small business UK
Know what personal data your business holds, why you have it and what you are supposed to do with it.
Polar Data Protection Starter helps UK startups and small businesses build the foundations of sensible data protection — personal-data awareness, lawful use, privacy information, retention, security, individual rights, ICO checks and a practical process for when something goes wrong.
UK GDPR foundations
Privacy notice guidance
Rights, security and ICO checks
Inside Polar · Data Protection Starter
Example
DATA PROTECTION STARTER
Your data protection picture
Work through what data the business holds and the responsibilities that come with it.
PERSONAL DATA CHECK
Northway Services Ltd
Customers
Data held
3 staff
HR records
Website
Enquiries
✓
Data inventory
Ready
✓
Privacy notice
Ready
3
Retention periods
Review
4
ICO fee check
Check
Next data-protection action:
decide how long old customer enquiry records should be kept after they are no longer needed.
Data protection for small business
GDPR starts when the business begins handling information about real people.
Customer names, email addresses, phone numbers, employee records, website enquiries and marketing lists can all involve personal data. The first job is understanding what the business already holds.
Know the reason
Understand why the business uses each category of information and the lawful basis supporting that use.
Protect and explain it
Keep information appropriately secure and tell people what the business does with their data.
UK GDPR principles
Good data protection is built around a handful of rules rather than a folder full of GDPR paperwork.
The UK GDPR principles shape how personal data should be collected, used, maintained, retained and protected.
Lawfulness, fairness and transparency
Use personal information lawfully, treat people fairly and be clear about what the business is doing.
Purpose limitation
Be clear why information is collected and avoid simply reusing it for unrelated purposes without proper consideration.
Data minimisation
Collect what the business actually needs rather than information that might perhaps be useful one day.
Accuracy
Take reasonable steps to keep important personal information accurate and up to date.
Storage limitation
Do not keep identifiable personal information indefinitely just because nobody remembered to delete it.
Security
Protect personal information appropriately against loss, misuse, unauthorised access and other security risks.
Small business GDPR checklist
Start with the data itself — not with downloading a privacy-policy template.
A useful data-protection setup begins with understanding what enters the business, where it goes and what happens to it afterwards.
“We don’t really collect data” usually lasts until somebody remembers email, invoices and customer records.
Most businesses process personal information somewhere, even if they have never thought of themselves as a “data business”.
Polar principle:
map the real information flow before writing the compliance documents.
map the real information flow before writing the compliance documents.
What information?
Names, contact details, payment information, staff records or anything else linked to identifiable people.
Where does it come from?
Website forms, email, phone calls, customers, employees, suppliers or another source.
Why do you have it?
Service delivery, contracts, employment, accounting, marketing or another legitimate purpose.
Where is it stored?
Email accounts, CRM, spreadsheets, accounting software, phones, cloud drives or paper files.
Who receives it?
Staff, accountants, payment providers, software suppliers, delivery companies or other recipients.
Privacy notice for small business
Tell people what happens to their information before they have to ask.
A privacy notice should reflect what the business really does with personal data rather than being copied from another company with completely different systems.
Your privacy notice should answer the questions a customer would reasonably ask.
The exact content depends on the business, but these are core pieces of information worth getting straight.
What do you collect?
Personal data
Describe the categories of information the business handles.
Why do you use it?
Purpose & lawful basis
Explain why the information is needed and the legal basis relied upon.
Who gets it?
Recipients
Explain relevant sharing with service providers, authorities or other organisations.
How long?
Retention
Explain how long data is kept or how the retention period is decided.
What rights exist?
Individual rights
Tell people about their rights and how to exercise them.
Who do they contact?
Business details
Make it clear how somebody can raise a privacy question or request.
Lawful basis for processing
“We have the data” is not the same thing as “we can use the data however we like”.
The business should identify an appropriate lawful basis for each significant type of personal-data processing rather than assuming consent is always the answer.
Contract
Some processing is necessary to provide a product or service somebody has agreed to buy.
Legal obligation
Some records or processing may be required because the business has a legal responsibility.
Legitimate interests
This can apply in appropriate circumstances, but the business needs to consider its interests alongside the rights of the individual.
Consent
Where consent is used it must meet the relevant standard and people must have genuine choice.
Vital interests
This basis may apply in limited circumstances involving protection of someone’s life.
Public task
Mainly relevant where processing is needed for certain public functions or official authority.
Data retention policy
Keeping everything forever is not a retention strategy.
Different information can justify different retention periods. The business should decide how long records are genuinely required and what happens when that period ends.
Three retention questions.
Keep information while there is a justified business or legal reason — then deal with it securely.
Why do we still need it?
Connect retention to a real purpose, legal requirement or continuing business need.
How long is justified?
Set periods or review criteria suitable for different categories of information.
What happens afterwards?
Delete, anonymise or otherwise deal with the data appropriately when it is no longer needed.
Data security for small business
Data protection is not complete if the privacy notice is perfect and the password is “password123”.
Security should match the type and sensitivity of the information the business holds and the risks around it.
Access
Give personal information only to the people who genuinely need it for their work.
Passwords and accounts
Use sensible account security and avoid unnecessary shared logins.
Devices
Protect laptops, phones and other devices that contain or access business information.
Backups
Make sure important business data can be recovered where appropriate.
Suppliers
Understand which external providers process personal data on behalf of the business.
People
Staff need to understand how personal information should be handled in everyday work.
Subject access requests and individual rights
People have rights over their personal information — and the request may arrive in ordinary language.
A customer or employee does not need to use a magic phrase for a data-protection request to matter. Businesses should know how to recognise and route requests appropriately.
Access
People can ask for access to personal information the business holds about them.
Rectification
Inaccurate personal information may need to be corrected.
Deletion
People can request erasure in circumstances where the relevant right applies.
Object or restrict
Certain processing can be challenged, objected to or restricted depending on the circumstances.
ICO registration and data protection fee
Check whether your business needs to pay the ICO data-protection fee rather than assuming “small business” means exempt.
Many organisations processing personal information must pay a data-protection fee to the Information Commissioner’s Office unless an exemption applies. The correct answer depends on what the business actually does with personal data.
Check the activity
Review how the business processes personal information rather than judging purely by size.
Check exemptions
Some processing activities may fall within exemptions from the fee requirement.
Record the outcome
Keep a note of the decision and review it if the way the business handles data changes.
Cookies and website privacy
Your website can collect information before anybody fills in a contact form.
Website forms, analytics, cookies, advertising tools, booking systems and account features can all create privacy and electronic-marketing considerations.
Contact forms
Explain how enquiry information will be used and retained.
Cookies
Understand which cookies or similar technologies the website uses and what consent or information requirements may apply.
Marketing tools
Check the data implications of email marketing, advertising pixels and other tracking technologies.
Personal data breach
Know who does what before the lost laptop, wrong email or hacked account becomes a Friday-afternoon emergency.
A data breach can involve loss, unauthorised disclosure, alteration, destruction or access to personal information. The business needs a process to identify what happened and what response is required.
Contain first. Understand second. Decide the reporting obligation quickly.
Not every incident is the same. The response should reflect the personal information involved and the risk to the people affected.
Initial breach response
Contain
Stop or limit the continuing loss, disclosure or unauthorised access where possible.
Record
Document what happened, when it happened and what information was involved.
Assess
Consider the likely consequences and level of risk to affected individuals.
Escalate
Check whether the ICO or affected individuals need to be informed under the applicable rules.
Data protection by design
It is easier to build privacy into the business than bolt it on after every system already contains customer data.
When the business introduces a new process, form, supplier or software tool, consider privacy at the beginning rather than after launch.
Before adding a new system, ask three questions.
Privacy by design turns data protection into a normal business decision rather than a yearly compliance ritual.
Do we need this data?
Minimise
Only collect information that supports the real purpose.
Who can access it?
Protect
Design sensible access and security around the information from the start.
What happens later?
Retain deliberately
Decide how the information will be maintained, reviewed and eventually removed.
Connected data protection
Privacy touches customers, staff, marketing, documents and the website — so keep it connected.
Polar Data Protection Starter sits alongside the areas where personal information is actually created and used.
Business Setup
→
Legal Guide
→
Data Protection
→
Website
→
Marketing
→
People
→
Document Vault
GDPR support for small business
Polar helps build the foundation. It does not award a magical “GDPR compliant forever” badge.
Data protection depends on what the business actually does and can change as systems, staff, customers and laws change. Polar helps organise the basics and identify issues that deserve further attention.
Understand
Know the information the business holds and why data-protection rules matter.
Document
Build sensible privacy information, retention decisions and internal records.
Review
Revisit the setup when the business adds new systems, people or ways of using data.
Small business GDPR FAQs
Questions about data protection and UK GDPR for small businesses.
Does GDPR apply to small businesses?
Yes. UK data-protection law can apply whenever a business processes personal information, regardless of whether the organisation is large or small.
What is personal data?
Personal data is information relating to an identified or identifiable individual. This can include names, contact details, employee records and many other types of information connected with a person.
Does my business need a privacy notice?
Businesses processing personal data generally need to give people appropriate privacy information explaining how their data is used.
What should a small-business privacy notice include?
It commonly includes the business’s identity and contact details, the personal data collected, why it is used, the lawful basis, recipients, retention information and the rights available to individuals.
Do I always need consent to use personal data?
No. Consent is one lawful basis, but other lawful bases include contract, legal obligation and legitimate interests where their conditions are met.
What is a subject access request?
A subject access request is a request by an individual to access personal information an organisation holds about them and related information about its use.
Does my business need to register with the ICO?
Many organisations processing personal information need to pay the ICO data-protection fee unless an exemption applies. Businesses should use the ICO’s current guidance to check their own circumstances.
How long can a business keep customer data?
There is no single retention period for every type of information. The business should keep personal data only for as long as there is a justified purpose or applicable legal requirement.
What should I do if personal data is lost or exposed?
Contain the incident where possible, record what happened, assess the risk and check whether notification to the ICO or affected individuals is required.
Does Polar certify that my business is GDPR compliant?
No. Polar Data Protection Starter provides practical guidance and helps organise the foundations of data protection. Compliance depends on the business’s actual processing activities and responsibilities.
Polar Data Protection Starter
Know the data. Know why you have it. Know what happens to it next.
Build a practical foundation for privacy notices, lawful processing, retention, security, individual rights, ICO checks and the everyday handling of personal information inside a growing small business.