Journey

Meet your data protection obligations

Ensure your business complies with UK GDPR and the Data Protection Act 2018. Covers ICO registration, lawful basis for processing, data subject rights, international transfers, breach notification, and electronic marketing rules under PECR.

Running a Business Updated 15 September 2026

8 milestones references 4 guides

Data protection compliance for UK businesses

Every business that processes personal data must comply with UK GDPR and the Data Protection Act 2018. This includes collecting customer details, managing employee records, operating CCTV, or running marketing campaigns.

The Information Commissioner's Office (ICO) enforces data protection law. Serious breaches can result in fines of up to 17.5 million pounds or 4% of annual worldwide turnover (whichever is higher). Beyond fines, poor data protection damages customer trust and can disrupt your business operations.

Register with the Information Commissioner's Office
Most businesses that process personal data must pay an annual data protection fee to the ICO. This applies whether you have one employee or thousands. The fee depends on your size and turnover.

Register with the ICO and understand your obligations

Learn about UK GDPR requirements, the seven data protection principles, and how to register your business with the ICO.
ICO registration fees

The fee is tiered based on your organisation size and turnover. Most small businesses pay the Tier 1 fee. You must renew annually.
Under the Data Protection (Charges and Information) Regulations 2018, most organisations that process personal data must pay an annual data protection fee to the Information Commissioner's Office (ICO).

Tier 1 fee (micro organisations)

£52 per year

Tier 1 threshold

Annual turnover up to £632,000 AND 10 or fewer staff

Tier 1 Direct Debit

£47 per year (£5 discount)

Tier 2 fee (SMEs)

£78 per year

Tier 2 threshold

Annual turnover up to £36 million AND 250 or fewer staff

Tier 2 Direct Debit

£73 per year (£5 discount)

Tier 3 fee (large organisations)

£3,763 per year

Tier 3 threshold

Annual turnover over £36 million OR over 250 staff

Tier 3 Direct Debit

£3,758 per year (£5 discount)

Effective from

17 February 2025

Charities

Pay Tier 1 fee only (£52), regardless of size or turnover

Penalty for non-payment

Up to 150% of the highest charge payable (DPA 2018 section 158(3)), plus the fee owed

Payment deadline after notice

28 days to pay or make representations

Renewal

Annual - ICO sends renewal reminder before expiry

Who must pay

You must register if your business:

Processes personal information about individuals (customers, employees, suppliers)

Uses CCTV (including smart doorbells or dashcams for business purposes)

Maintains marketing lists

Uses cookies on your website

Limited exemptions

Very few organisations are exempt. You may be exempt only if you:

Only process personal data for personal or household purposes (not business)

Are an MP, elected representative, or judge (specific exemptions)

Have no automated processing (no computers, no CCTV) - extremely rare

Most businesses are NOT exempt - if you have customer or employee data, you almost certainly need to pay.

Pay the data protection fee (opens in a new tab)

ICO fee self-assessment tool (opens in a new tab)
Identify your lawful basis for processing

You need a valid legal reason (lawful basis) for every type of personal data you process. The six lawful bases under UK GDPR are: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Choosing the wrong basis - or having no basis at all - is a fundamental breach.

The lawful bases under UK GDPR

Document which lawful basis applies to each processing activity. You cannot change your lawful basis later without a valid reason, so get this right from the start.

Under UK GDPR Article 6, you must have a valid lawful basis to process personal data. You cannot process personal data without identifying at least one lawful basis that applies to each processing activity.

1. Consent (Article 6(1)(a))

The individual has given clear, specific, informed consent for you to process their personal data for a specific purpose

2. Contract (Article 6(1)(b))

Processing is necessary to fulfil a contract with the individual, or to take steps at their request before entering a contract

3. Legal obligation (Article 6(1)(c))

Processing is necessary to comply with a common law or statutory obligation under UK law

4. Vital interests (Article 6(1)(d))

Processing is necessary to protect someone's life

5. Public task (Article 6(1)(e))

Processing is necessary for performing a task in the public interest or for official functions that have a clear basis in law

6. Legitimate interests (Article 6(1)(f))

Processing is necessary for your legitimate interests or those of a third party, unless overridden by the individual's interests, rights, or freedoms

Consent requirements: Must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.

Legitimate interests: Requires a documented Legitimate Interest Assessment (LIA) balancing test. Not available to public authorities for their core tasks.

7. Recognised legitimate interests (NEW - from February 2026)

Processing necessary for certain pre-approved purposes without requiring a balancing test (Data (Use and Access) Act 2025)

Recognised purposes include

National/public security, defence, emergencies, crime prevention/detection, safeguarding vulnerable individuals

Effective date

5 February 2026

Note: Direct marketing and intra-group data sharing still require a Legitimate Interest Assessment even under recognised legitimate interests.

ICO guide to lawful basis (opens in a new tab)

Guv’s take

Special category data: Some types of personal data need extra protection - including health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and sexual orientation. You need both a lawful basis AND a separate condition under Article 9 to process this data.
Respond to data subject rights requests
Individuals have rights over their personal data. When someone makes a request - such as asking for a copy of their data or asking you to delete it - you must respond within one month. Failing to do so is a breach that individuals can complain to the ICO about.
Individual rights under UK GDPR

Train your staff to recognise rights requests and have a process for handling them. Not all rights apply in all circumstances, but you must assess each request properly.
Individuals have the following rights regarding their personal data:

Right to be informed - know how you use their data

Right of access (DSAR) - request copies of their data

Right to rectification - have inaccurate data corrected

Right to erasure - have data deleted ("right to be forgotten")

Right to restrict processing - limit how you use data

Right to data portability - receive data in portable format

Right to object - object to processing

Rights related to automated decisions - challenge automated profiling

DSAR response deadline

1 month (can extend to 3 months for complex requests)

DSAR cost

Free (unless manifestly unfounded/excessive)
Data protection overview and compliance requirements

Detailed guidance on handling Subject Access Requests, erasure requests, and other data subject rights.
Ensure lawful international data transfers

Transferring personal data outside the UK requires additional safeguards. This applies whenever you use cloud services hosted abroad, share data with overseas partners, or send employee information to a foreign head office. Many businesses underestimate how many international transfers they make.

International data transfer requirements

Understand adequacy decisions, Standard Contractual Clauses, the UK IDTA, Transfer Risk Assessments, and when exemptions apply.

Guv’s take

Countries with UK adequacy decisions: Transfers to the EEA, Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, and US (certified DPF organisations) can proceed without additional safeguards. For all other countries, you need SCCs, the UK IDTA, or another approved mechanism.
Report data breaches within 72 hours
When a data breach occurs, you have just 72 hours to report it to the ICO if it poses a risk to individuals. Some breaches also require you to notify the affected individuals directly. Having a breach response plan before an incident occurs is essential - you will not have time to work out your process during a crisis.

Data breach response requirements

What counts as a reportable breach, how to assess risk, the 72-hour notification deadline, and what to tell affected individuals.
72-hour breach notification rule

The clock starts when you become aware of a breach. If you cannot report within 72 hours, you must explain the delay. Document all breaches, even those you decide not to report.
UK GDPR requires data controllers to report certain personal data breaches to the ICO and, in some cases, to the individuals affected.

ICO notification deadline

Within 72 hours of becoming aware of the breach

Clock starts when

You have 'reasonable certainty' a breach has occurred, not when you know full details

When notification required

If the breach is likely to result in a risk to people's rights and freedoms

When notification NOT required

If breach is unlikely to result in any risk to individuals - but must still record internally

Individual notification

Required without undue delay if risk to individuals is HIGH

Legislation

UK GDPR Articles 33 and 34

Required notification content (Article 33(3))

Nature of the breach (what happened)

Categories and approximate numbers of individuals affected

Categories and approximate numbers of records affected

Name and contact details of your DPO or other contact point

Likely consequences of the breach

Measures taken or proposed to address the breach and mitigate harm

Phased reporting

If full information unavailable within 72 hours, report what you know and provide details later 'without undue further delay'

Internal record-keeping

ALL breaches must be documented (whether notified to ICO or not) for audit purposes

Penalty for notification failure

Up to £8.7 million or 2% of global annual turnover (whichever is higher)

Report a breach to the ICO (opens in a new tab)
Comply with electronic marketing rules (PECR)
The Privacy and Electronic Communications Regulations (PECR) set additional rules for marketing emails, texts, and telephone calls. These work alongside UK GDPR. Getting consent wrong for marketing is one of the most common reasons for ICO enforcement action.

Electronic marketing rules under PECR

Consent requirements, the soft opt-in exception for existing customers, TPS screening for calls, and avoiding ICO penalties.

PECR maximum penalties

Following the Data Use and Access Act 2025, PECR fines now align with GDPR levels. The ICO regularly issues substantial fines for nuisance calls and unsolicited marketing.

From 5 February 2026, maximum penalties for PECR breaches have been aligned with UK GDPR levels under the Data (Use and Access) Act 2025.

Previous maximum fine

£500,000

New maximum fine (from 5 February 2026)

£17.5 million or 4% of global annual turnover, whichever is higher

Effective date

5 February 2026

Legal basis

Data (Use and Access) Act 2025

Applies to

Unlawful email/SMS marketing, telemarketing, cookies/tracking breaches

Regulator

Information Commissioner's Office (ICO)

Common PECR breaches

Unsolicited marketing, ignoring opt-outs, manipulative cookie consent

ICO enforcement (2022-2025)

49 PECR fines totalling £4.63 million

Average fine (pre-2025)

£94,490

Expected focus areas

Mass unsolicited communications, TPS/CTPS violations, deceptive consent flows

ICO PECR enforcement guidance (opens in a new tab)
Cookie consent requirements

PECR also covers cookies and similar tracking technologies. Most cookies require consent before being placed on a user's device.
The Privacy and Electronic Communications Regulations 2003 (PECR) require consent before setting non-essential cookies.

Consent requirements:

Clear and comprehensive information about cookies

Genuine choice - no "cookie walls" forcing acceptance

Easy to withdraw consent

No pre-ticked boxes

Exempt cookies:

Strictly necessary for the service (e.g., shopping cart)

Enabling user-requested functionality

Analytics cookies, advertising cookies, and social media cookies require consent.
Understand the consequences of non-compliance
The ICO has significant enforcement powers. Beyond fines, the ICO can issue enforcement notices requiring you to stop processing data, conduct compulsory audits, and publicise your failings. Serious breaches damage your reputation and can result in legal action from affected individuals.
UK GDPR maximum fines

There are two tiers of fines. The higher tier applies to fundamental breaches such as processing without lawful basis, ignoring data subject rights, or unlawful international transfers.
The ICO can issue administrative fines under UK GDPR Article 83 and DPA 2018 Section 157. There are two tiers of maximum fines depending on the type of infringement.

Higher tier maximum

£17.5 million or 4% of annual worldwide turnover, whichever is HIGHER

Higher tier applies to

Breaches of data protection principles (Article 5), lawful basis requirements (Articles 6, 7, 9), data subject rights (Articles 12-22), unlawful international transfers (Articles 44-49)

Standard tier maximum

£8.7 million or 2% of annual worldwide turnover, whichever is HIGHER

Standard tier applies to

Failure to comply with controller/processor obligations, processing children's data incorrectly, certification failures, breach notification failures

Infringements attracting higher tier fines (£17.5m / 4%)

Breaching data protection principles (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability)

Processing without valid lawful basis

Failing to obtain valid consent where required

Processing special category data without a valid condition

Failing to respect data subject rights (access, rectification, erasure, portability, objection)

Unlawful transfers of personal data to third countries

Infringements attracting standard tier fines (£8.7m / 2%)

Failure to comply with controller or processor obligations under Chapter IV

Processing children's data incorrectly (Article 8)

Failure to notify data breaches to ICO within 72 hours

Failure to notify individuals of high-risk breaches

Failure to comply with certification requirements

Multiple infringements

For same or linked processing operations, total fine cannot exceed amount for gravest infringement

Unlinked operations

Separate fines for unlinked operations can exceed statutory maximum when summed

ICO approach

Fines should be effective, proportionate, and dissuasive in each individual case

Legislation reference

UK GDPR Article 83, DPA 2018 Sections 155-157

ICO fining guidance (opens in a new tab)

ICO enforcement actions (opens in a new tab)
Take note

Higher tier fines (up to 17.5m / 4% turnover): Breaches of data protection principles, processing without valid lawful basis, failing to respect data subject rights, unlawful international transfers.

Standard tier fines (up to 8.7m / 2% turnover): Failure to notify breaches within 72 hours, incorrect processing of children's data, certification failures.
Maintain ongoing compliance

Data protection is not a one-off exercise. Review your processing activities regularly, update your privacy notices when things change, train new staff, and keep records of your compliance efforts. The ICO expects organisations to embed data protection into their operations.

Guv’s take

Accountability principle: Under UK GDPR, you must be able to demonstrate your compliance - not just claim you are compliant. Keep records of your lawful basis decisions, consent records, Data Protection Impact Assessments, and training logs.

Meet your data protection obligations

Data protection compliance for UK businesses

Register with the Information Commissioner's Office

Register with the ICO and understand your obligations

Identify your lawful basis for processing

Respond to data subject rights requests

Data protection overview and compliance requirements

Ensure lawful international data transfers

International data transfer requirements

Report data breaches within 72 hours

Data breach response requirements

Comply with electronic marketing rules (PECR)

Electronic marketing rules under PECR

Understand the consequences of non-compliance

Maintain ongoing compliance

Related journeys

Data protection compliance checklist

Run a tech business

Understanding UK GDPR from scratch

Marketing compliance: PECR and UK GDPR