Data protection compliance

Data protection for businesses

How to comply with UK GDPR and the Data Protection Act 2018. Covers ICO registration, lawful bases for processing, data subject rights, breach notification requirements, and penalties for non-compliance.

UK-wide
Guide summary

You must follow UK data protection laws if your business collects or uses personal information. Register with the ICO, have a lawful reason for processing data, and keep it safe. Fines for breaking the rules can be very high.

  • Register with the ICO and pay a fee (£52-£3,763 per year)
  • Have a lawful reason for processing personal data
  • Tell people how you use their data
  • Only collect data you need and PCI
  • Keep personal data accurate and up to date
  • Delete data when you no longer need it
  • Protect data with security measures
  • Report data breaches within 72 hours
  • Face fines up to £4,350 for not}F paying ICO fee
  • New recognised Legitimate interests basis from June 2025
On this page
UK-wide

Related guides in Compliance & Legal

If your business collects or uses information about people (personal data), you must comply with UK data protection law. This includes the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Personal data is any information relating to an identified or identifiable living person. This includes names, email addresses, phone numbers, IP addresses, employee records, and customer information.

Who must comply

All UK businesses that process personal data must comply, regardless of size. This includes:

  • Sole traders with customer records
  • Small businesses with employee data
  • Online retailers with customer orders
  • Service providers with client information
  • Any business using marketing lists or website cookies

The seven data protection principles

UK GDPR Article 5 sets out seven key principles that apply to all personal data processing. You must be able to demonstrate compliance with these principles.

1. Lawfulness, fairness and transparency
Process personal data lawfully, fairly and in a transparent manner. You need a lawful basis and must tell people what you're doing with their data.
2. Purpose limitation
Collect data for specified, explicit and legitimate purposes only. Don't use it for new purposes incompatible with the original reason.
3. Data minimisation
Only collect data that is adequate, relevant and limited to what's necessary for your purposes.
4. Accuracy
Keep personal data accurate and up to date. Take reasonable steps to correct or delete inaccurate information promptly.
5. Storage limitation
Keep personal data only for as long as necessary for your purposes. Define retention periods and delete data when no longer needed.
6. Integrity and confidentiality (security)
Process data securely with appropriate technical and organisational measures. Protect against unauthorised access, loss, or damage.
7. Accountability
Take responsibility for compliance and be able to demonstrate it. Keep records of processing activities and implement appropriate policies.

Penalties for non-compliance

Breaching the data protection principles can result in substantial fines. The ICO can also issue enforcement notices and stop you processing personal data. See the breach notification section below for penalty amounts.

Lawful bases for processing

You must have at least one lawful basis to process personal data. There are now seven lawful bases under UK GDPR (including the new 'recognised legitimate interests' added by the Data Use and Access Act 2025).

Document your decision: Record which lawful basis applies to each processing purpose and justify why. For legitimate interests, conduct a balancing test (Legitimate Interest Assessment). The new 'recognised legitimate interests' basis removes the need for a balancing test for specific pre-approved purposes.

ICO registration and fees

Most businesses must register with the Information Commissioner's Office (ICO) and pay an annual data protection fee. This is a legal requirement under the Data Protection (Charges and Information) Regulations 2018.

When to register

You must register before you start processing personal data. For most businesses, this means from day one. See the penalty for non-payment in the fee information above.

Registration process:

  1. Self-assess your tier using ICO's online tool
  2. Register online at ico.org.uk
  3. Pay annual fee by Direct Debit or card
  4. Receive confirmation (your registration appears on ICO's public register)
  5. Renew annually when ICO sends reminder

Privacy notices

You must provide clear information to individuals about how you use their personal data. This is usually done through a privacy notice (also called a privacy policy).

What to include in your privacy notice

UK GDPR requires you to provide specific information when collecting personal data:

  • Your identity and contact details - Business name and how to contact you
  • Why you're using the data - The purposes of processing
  • Lawful basis - Which Article 6 (or Article 9 for special category data) basis applies
  • Who you share data with - Name specific recipients or detailed categories (avoid vague terms like "business partners")
  • International transfers - If you send data outside the UK and what safeguards apply
  • Retention periods - How long you'll keep the data (be specific, not just "as long as necessary")
  • Individual rights - Right to access, rectification, erasure, portability, objection
  • Right to complain - How to contact the ICO
  • Right to withdraw consent - If consent is your lawful basis

Format and timing

Your privacy notice must be:

  • Concise and transparent - Written in clear, plain language
  • Easy to access - Prominent link on your website, included in forms
  • Timely - Provided at the time of data collection (or within one month if obtained from third parties)

Free ICO tool: Small businesses can use the ICO's privacy notice generator to create a compliant privacy notice.

  1. 1

    Use specific retention periods

    Don't just say 'as long as necessary'. State actual timeframes: e.g., 'Customer orders: 7 years for tax purposes, then deleted'.

  2. 2

    Name data recipients clearly

    Avoid vague categories like 'analytics providers'. Name specific companies or provide detailed categories explaining who they are and why you share data.

  3. 3

    Review and update regularly

    Update your privacy notice whenever you change how you process data or add new processing activities.

Data subject rights

Individuals have specific rights over their personal data under UK GDPR. You must have processes in place to respond to these requests.

Right of access (Subject Access Request)
Individuals can request a copy of their personal data. You must respond within 1 month, free of charge (in most cases).
Right to rectification
Individuals can request inaccurate data be corrected or incomplete data completed. Respond without undue delay.
Right to erasure ('right to be forgotten')
Individuals can request deletion in certain circumstances. You must comply if a lawful ground applies (e.g., data no longer needed, consent withdrawn).
Right to restrict processing
Individuals can request you stop processing their data in certain situations (e.g., while verifying accuracy).
Right to data portability
Individuals can request their data in a structured, commonly-used format to move to another service. Applies when processing is based on consent or contract.
Right to object
Individuals can object to processing based on legitimate interests, direct marketing, or for research purposes.
Rights regarding automated decision-making
Individuals can request human intervention for decisions made solely by automated processing that significantly affects them.
  1. 1

    Respond within 1 month

    You have 1 month to respond to most data subject rights requests. Can be extended by 2 months for complex requests if you explain the delay.

  2. 2

    Verify identity

    You can request reasonable information to confirm the person's identity before responding to a subject access request.

  3. 3

    Keep records

    Document how you handle each request, your decision, and the outcome. This demonstrates accountability.

  4. 4

    Inform third parties

    If you've shared data with others, you must inform them of rectifications, erasures or restrictions (unless impossible or disproportionate).

Data breach notification

If you experience a personal data breach, you must assess the risk to individuals and report it to the ICO if required. A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of personal data.

The 72-hour rule explained

The 72-hour clock starts when you have reasonable certainty that a security incident has compromised personal data - not when you know all the details.

Phased reporting is allowed: If you can't complete a full investigation within 72 hours, report what you know initially and provide additional information in phases "without undue further delay". The ICO actively encourages this "report early, update later" approach.

When to report
If the breach is likely to result in a risk to people's rights and freedoms (financial loss, identity theft, discrimination, distress).
When NOT to report
If the breach is unlikely to result in any risk to individuals. Still document it internally for ICO audits.
High-risk breaches
If high risk to individuals, you must also notify them directly without undue delay, in clear language.
How to report
Use ICO's online breach reporting tool or call 0303 123 1113 (office hours).
  1. 1

    Document ALL breaches

    Keep internal records of all breaches, whether reported to ICO or not. Record nature, effects, and remedial action taken.

  2. 2

    Include required information

    Breach notification must include: nature of breach, categories/numbers of people affected, DPO contact details, likely consequences, and measures taken.

  3. 3

    Have an incident response plan

    Prepare in advance with clear procedures for detecting, investigating, and reporting breaches within tight timeframes.

Penalties for non-compliance

The ICO has significant enforcement powers under UK GDPR and DPA 2018. Fines operate on a two-tier structure depending on the nature of the infringement.

Beyond fines: The ICO can also issue enforcement notices requiring you to stop processing, reprimands, orders to communicate breaches to individuals, and orders to comply with data subject requests. Serious non-compliance can result in criminal prosecution.

Record keeping and documentation

UK GDPR requires most organisations to maintain records of processing activities. This demonstrates accountability and helps you comply with transparency obligations.

When records are required

You must keep processing records if:

  • You have 250 or more employees, OR
  • Your processing is likely to result in a risk to individuals (even with fewer than 250 employees), OR
  • You process special category data or criminal conviction data (even with fewer than 250 employees)

In practice: Most businesses should maintain processing records regardless of size, as it helps demonstrate compliance.

What to record
Purposes of processing, categories of data subjects and personal data, categories of recipients, retention periods, security measures, international transfers.
Format
No prescribed format. Can be a spreadsheet, database, or ICO's template. Must be available to ICO on request.
Review frequency
Review and update whenever you change processing activities or add new purposes.

Data Protection Officer (DPO)

Some organisations must appoint a Data Protection Officer. For most small businesses, this is optional.

DPO requirements (if appointed)

A DPO must:

  • Have expert knowledge of data protection law and practices (proportionate to your processing)
  • Be independent - no conflict of interest, can't be dismissed for performing duties
  • Report to highest management level
  • Be adequately resourced to perform tasks
  • Be accessible to individuals, staff, and the ICO

Key tasks: Inform and advise on compliance, monitor compliance, train staff, advise on data protection impact assessments, cooperate with the ICO, act as contact point.

Can be internal or external: You can appoint a staff member (if qualified and no conflicts) or outsource to a service provider. Groups of companies can share a single DPO if easily accessible.

Practical compliance checklist

Use this checklist to ensure basic GDPR compliance:

  1. 1

    Register with ICO and pay fee

    Complete registration before processing personal data. Use the tier information earlier in this guide to identify your correct fee tier.

  2. 2

    Identify your lawful bases

    Document which lawful basis applies to each processing purpose. Conduct legitimate interest assessments where needed.

  3. 3

    Create privacy notice

    Draft clear privacy notice with all required information. Display prominently on website and in customer communications.

  4. 4

    Implement security measures

    Use appropriate technical and organisational measures: encryption, access controls, secure passwords, regular backups, staff training.

  5. 5

    Plan for data subject requests

    Create processes to handle access requests, rectifications, erasures within required timeframes (1 month standard).

  6. 6

    Set up breach procedures

    Establish incident response plan to detect, assess, and report breaches within 72 hours if required.

  7. 7

    Maintain processing records

    Document: purposes, data categories, retention periods, recipients, security measures, transfers.

  8. 8

    Review and update regularly

    Schedule annual reviews of privacy notices, processing records, security measures, and staff training.

  9. 9

    Train your staff

    Ensure everyone handling personal data understands their responsibilities and knows how to spot security risks.

  10. 10

    Consider data protection by design

    Build privacy into new projects and systems from the start. Conduct Data Protection Impact Assessments for high-risk processing.

Healthcare & Social Care Requirement

Healthcare & Social Care businesses only

Healthcare providers process 'special category data' under UK GDPR, requiring enhanced protection:

  • Lawful basis plus special category condition: You need both Article 6 lawful basis AND an Article 9 condition (typically 'health or social care purposes' under Article 9(2)(h))
  • Caldicott Principles: NHS organisations and larger private providers must appoint a senior Caldicott Guardian to oversee patient data protection
  • Common law duty of confidentiality: Applies alongside GDPR - patients reasonably expect their health information to be kept confidential
  • Professional obligations: Clinical staff have additional duties under their professional codes (GMC, NMC, etc.)

Breaching patient confidentiality can result in ICO enforcement, professional misconduct proceedings, and civil liability.

Who this applies to: CQC-registered healthcare providers, GP practices, dental practices, pharmacies
ICO special category data guidance (opens in a new tab)