Question 1

What does data protection law actually require of a small business?

Accepted Answer

Less bureaucracy than most small businesses fear and **more discipline about basic practice** than most currently apply. The obligations scale with what you do with personal data, not with your size — but the regime is explicitly risk-based, so a small business doing ordinary things faces a light load.

**What triggers the rules.** Processing **personal data** — any information relating to an identifiable living person. Customer records, staff files, CCTV, marketing lists, and an email address are all personal data.

**The core obligations:**

**Have a lawful basis** for each processing purpose. Consent is **one of six** and frequently the worst choice, because it must be freely given and can be withdrawn. **Contract** and **legitimate interests** cover most ordinary business activity.

**Tell people what you do**, through an accessible privacy notice written in plain language.

**Collect only what you need**, and keep it only as long as you need it. A written retention schedule is unglamorous and is the fix for a large share of risk.

**Keep it secure**, with measures proportionate to the risk — access control, encryption of portable devices, patched systems, and staff awareness.

**Honour individual rights**, including access, correction, erasure and objection, generally within one month.

**Report serious breaches** to the regulator within 72 hours where the criteria are met, and to affected individuals where the risk is high.

**Register with the regulator** and pay the data protection fee, which most organisations must do.

**Contracts with processors** — anyone handling data on your behalf, including most cloud services — must contain specified terms.

**Where small businesses actually get caught:**

**Marketing rules**, which are separate and stricter: unsolicited electronic marketing to individuals generally needs consent, and enforcement here is frequent and expensive.

**Subject access requests**, which are free, must be answered, and are frequently used in employment disputes.

**Old data** kept indefinitely with no reason.

**Unsecured personal devices and shared logins.**

General information, not legal advice.

Question 2

What policies does a small business actually need?

Accepted Answer

Fewer than consultants suggest and more than most small businesses have — and the useful test is whether a policy answers a question that will otherwise be decided inconsistently, not whether it

Question 3

What should a small business actually prepare for, and what is business continuity planning?

Accepted Answer

Planning for how you would keep operating, or resume quickly, when something disrupts you — and for a small business the useful version is short, specific and focused on the handful of things that

Question 4

What records must a business keep, and for how long?

Accepted Answer

Enough to support every figure in your accounts and tax returns, kept for a statutory minimum period that varies by record type and jurisdiction — and the burden of proof is on you, not on the

Question 5

What are your health and safety obligations as a small employer?

Accepted Answer

A general duty to ensure health and safety so far as is reasonably practicable, plus a short list of specific requirements. The phrase does the heavy lifting: it means weighing risk against the cost

Question 6

What information about my company is public at Companies House?

Accepted Answer

Considerably more than most people expect, and it is free for anyone to search — competitors, customers, journalists and members of the public included. What is always public: Company name, number,

Question 7

What is a retainer, and how should you structure one?

Accepted Answer

An ongoing arrangement where a client pays regularly rather than per project. It converts unpredictable project income into recurring revenue — and badly structured retainers are one of the most

Related Questions