The complete guide to software for a small business

Software now runs almost every part of a small business, from quotes and invoices to bookings, email and customer records. Choosing it well saves hours each week, while choosing it badly locks you into costs, workarounds and risk. This guide walks through the whole life of business software: working out what you need, comparing options, keeping data safe and legal, backing up, controlling costs, moving between systems and helping people use it properly. It is written for owners and managers of small UK businesses who are not IT specialists.

Start with the work, not the product

The most common reason software disappoints is that it was chosen before anyone wrote down what it had to do. Before looking at any product, list the jobs your business does every week and where they currently slow down, such as retyping customer details, chasing unpaid invoices or searching emails for a job history. Each pain point becomes a requirement you can test against.

Talk to the people who actually do the work, not only the person paying for the software. Someone who books jobs or answers the phone will know problems that never reach the owner. Ask them what they do each day, what they copy from one place to another and what they would stop doing if they could.

Sort your requirements into three groups: must have, should have and nice to have. A must-have is something the business cannot run without, such as producing a VAT-compliant invoice if you are VAT registered or working on a phone on site. Keep the must-have list short and specific, because a long list of vague wishes makes every product look equally good.

Finally, note your constraints. These include your budget, the devices people use, how good the internet connection is where you work, any software you must keep and how much time you can give to setting things up. A realistic view of constraints rules out many options before you waste time on trials.

• List weekly tasks and where time is lost
• Ask the people who do the work
• Split requirements into must, should and nice to have
• Record budget, devices, connectivity and time available

Cloud, desktop or a mix

Cloud software, often sold as software as a service, runs on the supplier's servers and you use it through a browser or app for a monthly or yearly subscription. Desktop software is installed on your own computers and may be bought outright or on a licence. Many businesses end up with a mix, and that is fine as long as it is a deliberate choice.

Cloud tools are usually quicker to start, work from anywhere and are updated for you. The supplier handles servers, patches and much of the security. The trade-offs are an ongoing subscription, dependence on an internet connection and dependence on the supplier staying in business and keeping prices reasonable.

Desktop software can suit specialist work, such as design, drawing or editing large files, and places with poor connectivity. You have more control over when updates happen, but you also carry more responsibility for backups, security updates and replacing hardware. If only one computer holds the data, that computer becomes a single point of failure.

Whichever route you take, ask one question early: how do I get all my data out, in a standard format, if I leave? Good suppliers answer this clearly. A product that makes exporting hard is quietly making switching expensive later.

Shortlisting and trialling properly

Aim for a shortlist of two or three products that meet every must-have on paper. Use independent sources, recommendations from similar businesses and the supplier's own documentation, but treat reviews and marketing with caution. Check whether the product is aimed at businesses of your size and type, because tools built for large firms can be heavy and expensive for a team of three.

Run a trial with your own real scenarios rather than the supplier's demo data. Pick three to five everyday tasks, such as creating a quote, turning it into an invoice and recording a payment, and time how long each takes. Involve at least one person who will use the tool every day and ask them to note anything confusing.

During the trial, test support as well as features. Ask a genuine question and see how quickly and clearly it is answered. Check what support is included in the plan you would actually buy, since some suppliers reserve phone or priority support for higher tiers.

Read the contract terms before you commit, especially the minimum term, notice period, how prices can change, where data is stored and what happens to your data when you cancel. Keep a copy of the terms and the date you accepted them with your business records. If anything is unclear, ask the supplier to confirm it in writing.

• Test with your own data and real tasks
• Time key tasks and record problems
• Try the support channel you will actually get
• Read minimum term, notice and price-change clauses

Security basics every small business needs

Most attacks on small businesses are not sophisticated. They rely on reused passwords, missing updates, phishing emails and accounts left open after someone leaves. The National Cyber Security Centre publishes free, plain-English guidance for small organisations, and the government-backed Cyber Essentials scheme sets out a short list of technical controls that stop many common attacks.

Turn on two-step verification for every business account that offers it, starting with email, because access to email usually unlocks everything else through password resets. Use a password manager so every account has a unique, strong password. Give each person their own login rather than sharing one account, so you can see who did what and remove access cleanly.

Keep operating systems, browsers and apps up to date, and replace devices that no longer receive security updates. Give people only the access they need for their role, and keep administrator rights to a small number of accounts that are not used for everyday email and browsing. Fewer powerful accounts means less damage if one is compromised.

Have a simple joiners and leavers routine. When someone starts, create their accounts from a checklist. When someone leaves, remove or disable their access on their last day, change any shared passwords they knew and recover company devices. This single habit closes one of the most common gaps in small firms.

• Two-step verification on email first, then everything else
• A password manager and one login per person
• Automatic updates on and unsupported devices replaced
• A written joiners and leavers checklist

Data protection in general terms

If your business handles information about identifiable people, such as customers, staff or suppliers who are sole traders, you are processing personal data and UK data protection law applies. The UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, set out the rules. The Information Commissioner's Office, known as the ICO, regulates this area and has guidance written specifically for small businesses.

The core principles are straightforward. Collect only what you need, use it for clear and fair purposes, keep it accurate, keep it secure, and do not keep it longer than necessary. Tell people how you use their information, usually through a privacy notice, and respond when they ask to see their data or ask for it to be corrected.

When you choose software that stores personal data, the supplier usually acts as your processor. You should have a written contract or terms covering how they handle the data, and you should know broadly where it is stored. Many suppliers publish a data processing agreement; keep a copy with your records.

Most organisations that process personal data must pay a data protection fee to the ICO unless they are exempt. Check whether this applies to you and the current fee on the ICO website. If your situation is complex, for example you handle health information or large amounts of data, get advice from a qualified professional.

Backups and business continuity

A backup is only useful if you can restore from it when you need to. Think about what would happen if a laptop was stolen, a supplier had a long outage or someone deleted a folder by mistake. For each important system, write down where the data lives, how it is backed up and how you would get working again.

A widely used rule of thumb is to keep at least three copies of important data, on two different types of storage, with one copy kept away from your premises. For cloud tools, do not assume the supplier keeps backups you can use; check what they offer and consider regular exports of key data such as customer lists, invoices and job records. Store those exports somewhere separate from the tool itself.

Test a restore at least a few times a year. Pick a real file or record, restore it to a safe place and check it opens correctly. Note how long it took. Testing is the only way to find out that a backup has quietly stopped working.

Keep a short continuity sheet printed and stored securely, listing key suppliers, account names, support contacts and who is responsible for what. In a crisis, people struggle to remember where things are, and a single page saves valuable time. Update it whenever a supplier or responsibility changes.

• Map where each important dataset lives
• Three copies, two types of storage, one off-site
• Export key data from cloud tools regularly
• Test a restore and record how long it took

Understanding and controlling costs

The price on the pricing page is rarely the full cost. Add up subscriptions per user, add-ons, payment processing fees, integrations, extra storage, training time, setup help and the time spent moving data. Also count the cost of not changing, such as hours lost to manual work each week.

Subscriptions creep. Tools are added for one project and never cancelled, and staff who have left still hold paid seats. Keep a simple software register listing each tool, what it is for, who owns it, how many users, the cost, the renewal date and the notice period. Review it at least twice a year.

Before a renewal, check whether you still use the tool, whether a cheaper plan would do and whether another tool you already pay for covers the same job. Negotiate annual terms only when you are confident you will use the product for the full year. Put renewal dates in a shared calendar with a reminder before each notice period ends.

For tax and accounting treatment of software costs, including whether a cost is an expense or a capital item, check current guidance on GOV.UK or ask your accountant. The rules and allowances can change, so avoid relying on figures you read in older articles. Keep invoices for every software purchase with your business records.

Migrating from one system to another

Moving to new software is a project, not a weekend task. Start by deciding what data must move, what can be archived and what can be left behind. Old, messy data copied straight into a new system brings old problems with it, so tidy duplicates and outdated records first.

Export a full copy of everything from the old system before you change anything, and store it safely. Do a test import with a small sample, check it carefully and fix mapping problems, such as fields that land in the wrong place or dates that change format. Only then move the full dataset.

Where possible, run old and new systems side by side for a short, fixed period and compare results, such as totals on invoices or counts of open jobs. Choose a clear cut-over date, tell customers if anything they see will change, and do not cancel the old subscription until you have confirmed that everything has arrived and you have a final export. Rushing this last step is where many migrations lose data.

Keep the old data for as long as you have legal or business reasons to, such as tax records that HMRC expects you to keep. Check the current record-keeping periods on GOV.UK. Store the archive securely and note where it is, so it can still be opened in a few years.

• Clean data before moving it
• Full export first, then a small test import
• Run side by side briefly and compare totals
• Cancel the old tool only after a final export

Training, adoption and ongoing care

Software only pays off when people use it consistently. Plan short, focused training sessions built around real tasks rather than a tour of every feature. Record simple how-to notes or short screen recordings for the tasks people do most often, and keep them somewhere easy to find.

Name one person as the owner of each system. Their job is to know how it is set up, handle user changes, watch for supplier announcements and be the first point of contact for questions. In a small firm this may be the owner, but it should be a deliberate choice.

Agree a few simple rules, such as where files are saved, how customers are named and which fields must always be filled in. Consistent habits are what make reports and searches trustworthy later. Check in after a month to see what is working and adjust.

Finally, review your software set-up once a year. Look at what you pay for, what people actually use, any security gaps and whether your needs have changed. A yearly review keeps your tools working for the business rather than the other way round.

Key terms explained

Software as a service (SaaS)

Software you use over the internet for a subscription, rather than installing and owning it. The supplier runs and updates it.

Requirements

A written list of what the software must do for your business. Good requirements are specific enough to test during a trial.

Two-step verification

A login that needs a second check, such as a code from an app, as well as a password. It stops most attacks that use stolen passwords.

Password manager

An app that creates, stores and fills in strong, unique passwords for each account, protected by one main password.

Personal data

Any information that relates to an identifiable living person, such as a name, email address or phone number.

Data processor

An organisation that handles personal data on your behalf, such as a cloud software supplier, following your instructions.

Data export

Getting a copy of your data out of a system in a standard format, such as a spreadsheet file, so you can keep or move it.

Cut-over

The point in a migration when you stop using the old system and start using the new one for real work.

Software register

A simple list of every tool the business uses, its owner, users, cost, renewal date and notice period.

Cyber Essentials

A government-backed certification scheme that sets out basic technical controls to protect organisations from common cyber attacks.

Common mistakes to avoid

• Choosing software from a demo before writing down requirements, so avoid it by listing must-haves first and testing against them.
• Sharing one login between several people, which you can avoid by giving each person their own account with the right permissions.
• Assuming a cloud supplier's backups cover you, so check what can be restored and keep your own regular exports.
• Forgetting subscriptions after a project ends, which a software register with renewal dates and a twice-yearly review prevents.
• Cancelling the old system before checking the migration, so always take a final full export and compare totals first.

Frequently asked questions