UK GDPR Compliance Checklist for Small Businesses

UK GDPR has applied since January 2021, incorporating the EU GDPR into UK law post-Brexit. Many small businesses remain non-compliant - not through intent but through gaps in process. This checklist covers the key obligations. Work through it with your team and document your responses.

Lawful basis and accountability

• Identify and document your lawful basis for processing each category of personal data
• Maintain a Record of Processing Activities (ROPA) - mandatory if you have 250+ employees, best practice for all
• Appoint a Data Protection Lead (DPO required for certain organisations - check whether this applies)
• Complete and review your privacy notices - they must explain what you collect, why, how long you keep it, and individuals' rights
• Conduct a Data Protection Impact Assessment (DPIA) for any high-risk processing activities

Data mapping

• Map all personal data your business holds: what it is, where it comes from, where it is stored, who has access
• Identify all third-party processors (cloud software, payroll providers, marketing platforms) and check you have DPAs in place
• Document how long each category of data is retained and apply a deletion schedule
• Confirm all data transfers outside the UK have an appropriate transfer mechanism in place

Individual rights

• Establish a process for handling Subject Access Requests (30-day response window)
• Document your process for handling erasure requests, restriction of processing, and objection to processing
• Ensure individuals can withdraw consent easily where consent is your lawful basis
• Brief your team on how to recognise and escalate a rights request

Security

• Ensure all personal data is stored with appropriate technical and organisational safeguards
• Use encryption for data at rest and in transit where personal data is involved
• Limit access to personal data on a need-to-know basis
• Implement a clear password policy and where possible enforce MFA on systems holding personal data

Breach response

• Document your data breach response procedure - who is notified, in what order, and how quickly
• Reportable breaches must be notified to the ICO within 72 hours of becoming aware
• Maintain a breach register even for non-reportable incidents
• Brief key staff on how to identify and escalate a potential breach immediately

ICO registration

Most organisations that process personal data must register with the ICO and pay the data protection fee (from £40/year). Check your exemption status at ico.org.uk. Failure to register is a criminal offence.

Back to all guides