Decide whether to trade as a sole trader or limited company. Many tech businesses choose limited companies for IP protection and investor appeal.
Tech businesses: Protect IP before going public
Protect your intellectual property before sharing code or ideas publicly. Copyright protects software automatically. Trademarks (from £205) protect branding. Patents protect novel inventions but must be filed before disclosure.
Applies to: All tech businesses with software, code, designs, or branding
Official guidance (opens in a new tab)
Business structure for tech startups
Limited companies are popular with tech businesses because they protect personal assets, make it easier to raise investment, and provide a structure for issuing share options to employees. However, sole trader structures are simpler for low-risk freelance developers or consultants.
Sole trader
Simplest to set up. You keep all profits but are personally liable for debts.
Partnership
Share responsibilities and profits. Partners share liability for business debts.
Limited company
Separate legal entity. Personal liability limited to investment, but more admin.
LLP
Partnership with limited liability. Must file accounts at Companies House.
Business structure affects tax liability, personal liability, and required paperwork. Professional advice is recommended when choosing the right structure.
Tech businesses: data protection fee required
Almost all tech businesses must pay the annual data protection fee (£52-£3,763 depending on size) to the Information Commission (formerly the ICO). UK GDPR compliance is mandatory from day one - you need a privacy policy, cookie consent, and breach reporting procedures.
Applies to: All tech businesses processing personal data
Official guidance (opens in a new tab)
Data protection essentials for tech businesses
GDPR compliance is critical for tech businesses. You must pay the data protection fee to the Commission before you start processing personal data - this means from day one if you have user accounts, analytics, or employee records.
Core data protection principles
Personal data must be:
Lawful, fair and transparent: Have a legal basis and inform people how you use their dataPurpose limitation: Only collect data for specified, explicit purposesData minimisation: Only collect what you needAccuracy: Keep data accurate and up to dateStorage limitation: Don't keep data longer than necessaryIntegrity and confidentiality: Keep data secureAccountability: Demonstrate compliance
Lawful bases for processing
You must have at least one of these legal bases:
Consent: Freely given, specific, informed agreementContract: Processing necessary to fulfil a contractLegal obligation: Required by lawVital interests: Protection of someone's lifePublic task: Official functions or public interestLegitimate interests: Your interests (unless outweighed by individual's rights)
Individual rights
You must facilitate these rights:
Right to be informed (privacy notices)
Right of access (subject access requests within 1 month)
Right to rectification
Right to erasure (right to be forgotten)
Right to restrict processing
Right to data portability
Right to object
Rights related to automated decision making and profiling
When to notify the Information Commission
You must notify the Information Commission (formerly the ICO) within 72 hours of becoming aware of a
personal data breach that poses a risk to people's rights and freedoms.
Step 1
Conduct a data audit to identify all personal data you process
Step 2
Document your lawful bases for each processing activity
Step 3
Create or update privacy notices for customers, users, and employees
Step 4
Implement data security measures appropriate to the risks (encryption, access controls)
Step 5
Establish procedures for handling subject access requests within 1 month
Step 6
Create a data breach response plan with Information Commission notification procedures
Step 7
Appoint a Data Protection Officer if required (public authorities, large-scale monitoring, or special category data)
Step 8
Maintain Records of Processing Activities (ROPA) if you have 250+ employees or high-risk processing
Step 9
Review and update data retention schedules
Step 10
Train staff on data protection obligations
ICO Guide to UK GDPR (opens in a new tab)
Pay your annual data protection fee to the Commission.
Separate your business and personal finances. Essential for limited companies, strongly recommended for sole traders.
Sole traders: Working-from-home expenses
Sole traders can use HMRC's simplified expenses for working from home if they work there for at least 25 hours a month, or calculate the business proportion of household costs. This is separate from the employee homeworking allowance. Check mortgage or lease terms and make sure home insurance covers business equipment.
Official guidance (opens in a new tab)
Limited companies: Employee homeworking expenses
A limited-company founder working as an employee or director may be able to claim tax relief on £6 a week without evidence of the exact additional household costs, where the employee homeworking conditions are met. This is not the sole-trader simplified-expenses scheme.
Official guidance (opens in a new tab)
Tech businesses: Professional indemnity insurance
Professional indemnity insurance is essential for tech consultancies and developers. Most B2B clients require proof of cover before signing contracts. Get this before your first client engagement.
Applies to: Tech consultancies, developers, IT contractors, and SaaS companies doing B2B work
Official guidance (opens in a new tab)
Business insurance for tech companies
Beyond professional indemnity, consider cyber insurance (covers data breaches and cyber attacks), employers' liability (legally required if you have employees), and contents insurance for equipment.
The insurance your business needs depends on what it does. Some types are required by law. Some are required by professional regulators. The rest are not required by law, but you may still need them for contracts or to protect your business. Each type below starts with its legal status, so you can see which group it is in.
Employers' Liability
Required by law if you employ anyone, with at least £5 million of cover. Covers claims from employees injured or made ill at work.
Motor Insurance
Required by law for any vehicle used for business on roads or in other public places. Driving uninsured is a criminal offence. Covers claims from accidents in vehicles used for work.
Professional Indemnity
Required by some professional regulators, for example for many solicitors, financial advisers and architects. Covers claims of negligent advice.
Public Liability
Not required by law, but clients and landlords often require it in contracts. Covers claims for injury to other people or damage to their property.
Products Liability
Not required by law, but essential if you make or sell goods. Covers claims from defective products.
Business Contents
Not required by law, but recommended if you have equipment or stock. Covers business assets against theft, fire and damage.
Business Interruption
Not required by law, but recommended if a fire or flood would stop you trading. Covers lost income when you cannot trade.
Cyber Insurance
Not required by law, but recommended if you hold personal data or rely on IT. Covers data breaches, ransomware and regulatory fines where insurable.
Key Person
Not required by law, but worth considering if your business depends on a few people. Covers the business if one of them dies or is incapacitated.
Choosing the right cover Do you employ anyone? Employers' Liability is required by lawDo you use vehicles for work? Business motor insurance is required by law for use on roads or in other public placesAre you in a regulated profession? Check whether your professional regulator requires Professional Indemnity, and how muchDo you deal with customers or visit other premises? Public Liability is not required by law, but clients and landlords often require itDo you make or sell physical products? Products Liability is not required by law, but essential
Start with the insurance the law requires: if you employ anyone, you must have employers' liability insurance with at least £5 million cover, and business vehicles need motor insurance.
Tech businesses: R&D Tax Credits
Tech companies developing innovative software may qualify for R&D tax credits worth up to 21.5% of qualifying costs. Claim via your CT600 return - consult an R&D specialist accountant to maximise claims. Loss-making startups can receive cash payments.
Official guidance (opens in a new tab)
Could save your tech business thousands in tax. Consult an R&D specialist accountant to maximise claims.
Tech businesses: IR35 off-payroll rules
IR35 rules determine whether contractors should be taxed as employees. If you hire contractors or operate through a personal service company, check status using HMRC's CEST tool before starting work.
Applies to: Tech contractors and businesses hiring contractors
Official guidance (opens in a new tab)
Essential reading if you're a tech contractor or hiring contractors. Check your status before starting work.
Limited companies must register for Corporation Tax.
Sole traders must register for Self Assessment.
Tech businesses: VAT for digital services
Register for VAT when turnover exceeds £90,000. Digital services (SaaS, apps) have special VAT rules based on customer location. All VAT-registered businesses must use Making Tax Digital compatible software.
Applies to: Tech businesses approaching £90,000 turnover
Official guidance (opens in a new tab)
You must register for VAT when your taxable turnover passes the registration threshold in any rolling 12 months, or when you expect it to pass the threshold within the next 30 days alone.
Tech businesses: Hiring your first developer
Register as employer with HMRC 4-6 weeks before first payday. Get Employers' Liability Insurance (£5m minimum). Consider EMI share options to attract tech talent - consult a specialist for tax-efficient structuring.
Applies to: Tech businesses hiring employees
Official guidance (opens in a new tab)
Register as employer before your first payday. Understand your obligations to avoid costly mistakes.
Employment contracts for tech teams
Tech businesses often include IP assignment clauses (ensuring code created belongs to company), restrictive covenants (non-compete, non-solicitation), and confidentiality clauses. Get legal advice for senior hires or when dealing with IP-intensive roles.
All employees and workers must receive a written statement of employment particulars. The principal statement (provided on or before day 1) must include core terms including pay, hours, holidays, sick pay, other paid leave, notice periods, job title, and employment duration. Additional particulars including pensions, collective agreements, and disciplinary procedures must be provided within 2 months.
Employer's name
Business or organisation name
Employee's name
Full legal name
Start date
Date employment begins
Job title or description
Brief description of work
Pay and frequency
Salary or wage rate and payment intervals
Notice periods
How much notice both parties must give
Planned change: statement of the right to join a trade union Section 58 of the Employment Rights Act 2025 will require an employer to give a worker a written statement that they have the right to join a trade union, at the same time as the written statement of employment particulars and at other prescribed times. The provision is in force only for the purpose of making regulations. The government timeline update of 22 October 2026 says the duty will take effect on 1 January 2027, subject to parliamentary processes. It is not law until then.
Written statement of employment particulars (opens in a new tab)
Tech businesses: Sponsor licence for international talent
To hire international developers without existing UK work rights, you need a sponsor licence (£611 for small businesses, with most applications decided within 8 weeks). Skilled Worker visas need at least the general salary threshold of £41,700 or the going rate for the job, whichever is higher. Alternative routes include Global Talent and Graduate visas.
Applies to: Tech companies hiring international workers
Official guidance (opens in a new tab)
Apply for sponsor licence to hire international tech talent. Essential for accessing global developer pool.
Tech businesses: Cookie consent and email marketing
PECR requires consent before placing non-essential cookies, such as marketing cookies. Some analytics cookies are exempt if conditions are met. B2C email marketing needs opt-in consent; B2B can use soft opt-in for existing contacts. The Commission can fine up to £17.5 million or 4% of worldwide turnover, whichever is higher, for breaches.
Applies to: Tech companies with websites, apps, or email marketing
Official guidance (opens in a new tab)
Implement compliant cookie consent banners and email marketing practices. Common area of non-compliance.
Tech businesses: SEIS and EIS for fundraising
SEIS gives investors 50% income tax relief and EIS gives 30%. Each scheme caps how much a company can raise, so check the limits before you plan a funding round. These schemes make tech startups significantly more attractive to angel investors. Get advance assurance from HMRC before fundraising.
Official guidance (opens in a new tab)
If you're raising investment for your tech startup, SEIS/EIS can make your company significantly more attractive to investors.
Beyond SEIS/EIS, consider Innovate UK grants, startup loans, and venture capital for tech businesses.