Retail & Consumer Goods Retail and consumer services

Data protection for retail businesses

UK GDPR compliance for retail businesses. Covers customer data handling, CCTV obligations, marketing consent, loyalty programme data, breach response, and ICO registration fees.

UK-wide
Guide summary

You must register with the ICO and pay an annual data protection fee if your retail business handles customer data. Set up clear privacy notices, get consent for marketing, and follow rules for CCTV and data breaches. Keep customer data secure and delete it when no longer needed.

  • Register with ICO and pay £40-£2,900 annual fee
  • Create a privacy notice explaining data use
  • Get opt-in consent for marketing emails and texts
  • Display CCTV signs and delete footage after 30 days
  • Report data breaches to ICO within 72 hours
  • Keep customer data accurate and delete when unnecessary
  • Train staff on data protection responsibilities
  • Respond to customer data requests within 1 month
  • Pay ICO fee before processing personal data
  • Use secure storage for customer information
On this page
UK-wide

Related guides in Data Protection

Annual retail compliance checklist

Quick annual compliance verification for established retailers. Covers consumer rights, pricing, age verification, data protection, Sunday trading, fire …

Retail sector market overview

UK retail market statistics, ecommerce growth trends, and investment opportunities for retailers operating in Great Britain.

Retail businesses handle personal data every day: customer names and addresses for deliveries, email addresses for marketing, payment card details, CCTV footage, and loyalty programme records. UK GDPR and the Data Protection Act 2018 govern how you collect, store, use, and delete this data.

This guide covers the retail-specific aspects of data protection. If you employ staff, you also have separate data protection obligations as an employer.

  1. 1

    1. Register with the ICO and pay your data protection fee

    Almost all businesses processing personal data must pay an annual fee to the Information Commissioner's Office (ICO). Register before you start processing personal data. The fee depends on your size and turnover.

  2. 2

    2. Identify what personal data you hold and why

    Map the personal data your business collects. Common retail data includes customer contact details, purchase history, loyalty programme records, CCTV footage, delivery addresses, and marketing preferences. Record the lawful basis for each type of processing.

  3. 3

    3. Write and publish your privacy notice

    Create a clear privacy notice explaining what data you collect, why, how long you keep it, and how customers can exercise their rights. Display it on your website, in-store, and at the point of data collection.

  4. 4

    4. Set up consent mechanisms for marketing

    Under PECR (Privacy and Electronic Communications Regulations), you need specific opt-in consent before sending marketing emails, texts, or making marketing calls. Use clear opt-in checkboxes (never pre-ticked) and keep records of when and how consent was given. Provide easy unsubscribe options in every communication.

  5. 5

    5. Establish CCTV compliance procedures

    If you operate CCTV, complete a Data Protection Impact Assessment, display clear signage at all entry points, set a retention policy (ICO recommends 30 days), and train staff on handling subject access requests for footage.

  6. 6

    6. Create a data breach response plan

    Prepare a plan for responding to data breaches. You must report breaches posing a risk to individuals to the ICO within 72 hours of becoming aware of them. Notify affected customers if the breach poses a high risk to their rights and freedoms.

ICO registration fees

Your fee tier depends on your organisation's size and turnover. Most small retailers fall into Tier 1 or Tier 2. You can check your tier and pay online through the ICO website.

CCTV in retail premises

CCTV is common in retail for security, loss prevention, and staff safety. However, operating CCTV makes you a data controller for the footage, bringing additional obligations under UK GDPR.

Loyalty programmes and customer data

If you run a loyalty scheme, you are processing personal data. Be clear with customers about what data you collect through the programme and how you use it. Common pitfalls include:

  • Using loyalty data for profiling or targeted marketing without a clear lawful basis
  • Sharing data with third parties (suppliers, marketing partners) without explicit consent or a transparent privacy notice
  • Retaining loyalty data indefinitely after a customer stops using the scheme
  • Not providing a way for customers to access, correct, or delete their loyalty data

What to do if something goes wrong

Common retail data breaches include: a laptop or tablet containing customer records being stolen, a mailing list being sent with all email addresses visible (CC instead of BCC), an online store being hacked, or CCTV footage being shared inappropriately.

If a breach occurs, contain it immediately, assess the risk to affected individuals, and report to the ICO within 72 hours if the breach poses a risk. Keep a record of all breaches, even those you decide not to report.

Official data protection guidance