Retail businesses handle personal data every day: customer names and addresses for deliveries, email addresses for marketing, payment card details, CCTV footage, and loyalty programme records. UK GDPR and the Data Protection Act 2018 govern how you collect, store, use, and delete this data.
If you employ staff, you also have separate data protection obligations as an employer.
-
Pay your data protection fee to the Information Commission
Almost all businesses processing personal data must pay an annual fee to the Information Commission (formerly the ICO). Pay it before you start processing personal data. The fee depends on your size and turnover.
-
Identify what personal data you hold and why
Map the personal data your business collects. Common retail data includes customer contact details, purchase history, loyalty programme records, CCTV footage, delivery addresses, and marketing preferences. Record the lawful basis for each type of processing.
-
Write and publish your privacy notice
Create a clear privacy notice explaining what data you collect, why, how long you keep it, and how customers can exercise their rights. Display it on your website, in-store, and at the point of data collection.
-
Set up consent mechanisms for marketing
Under PECR (Privacy and Electronic Communications Regulations), you need specific opt-in consent before sending marketing emails, texts, or making marketing calls. Use clear opt-in checkboxes (never pre-ticked) and keep records of when and how consent was given. Provide easy unsubscribe options in every communication.
-
Establish CCTV compliance procedures
If you operate CCTV, complete a Data Protection Impact Assessment, display clear signage at all entry points, set a retention policy (the Commission recommends 30 days), and train staff on handling subject access requests for footage.
-
Create a data breach response plan
Prepare a plan for responding to data breaches. You must report breaches posing a risk to individuals to the Commission within 72 hours of becoming aware of them. Notify affected customers if the breach poses a high risk to their rights and freedoms.
Data protection fees
Your fee tier depends on your organisation's size and turnover. Most small retailers fall into Tier 1 or Tier 2. You can check your tier and pay online through the Commission's website.
CCTV in retail premises
CCTV is common in retail for security, loss prevention, and staff safety. However, operating CCTV makes you a data controller for the footage, bringing additional obligations under UK GDPR.
Loyalty programmes and customer data
If you run a loyalty scheme, you are processing personal data. Be clear with customers about what data you collect through the programme and how you use it. Common pitfalls include:
- Using loyalty data for profiling or targeted marketing without a clear lawful basis
- Sharing data with third parties (suppliers, marketing partners) without explicit consent or a transparent privacy notice
- Retaining loyalty data indefinitely after a customer stops using the scheme
- Not providing a way for customers to access, correct, or delete their loyalty data
What to do if something goes wrong
Common retail data breaches include: a laptop or tablet containing customer records being stolen, a mailing list being sent with all email addresses visible (CC instead of BCC), an online store being hacked, or CCTV footage being shared inappropriately.
If a breach occurs, contain it immediately, assess the risk to affected individuals, and report to the Commission within 72 hours if the breach poses a risk. Keep a record of all breaches, even those you decide not to report.
Legal basis
Primary legislation and key regulations