Make your small business UK GDPR compliant in 30 days

This guide is for owners and managers of UK businesses with up to about 50 staff who know they hold customer, staff and supplier data but have never done data protection properly, or did it in 2018 and stopped. It works as a 30-day project: one person, a shared folder and a few hours most days. You will finish with a data map that doubles as your record of processing, a lawful basis for every use, privacy notices, signed processor terms from every software supplier, a retention schedule, a breach plan and trained staff. It is general information, not legal advice; for complex or high-risk processing, such as large volumes of health data, get help from a data protection specialist.

What is inside

• Full step-by-step method9 detailed steps with decision points
• Ready-to-use templatesData map and record of processing (spreadsheet columns) · Email to a software supplier asking for processor terms and transfer details · Privacy notice skeleton for your website
• Timed action plan8 stages from “Days 1–2” to “Every quarter”
• Costly mistakes to avoid4 traps and what to do instead
• Complete checklist12 items to tick off
• Insider tips and fixes4 tips and 4 common problems solved

Step by step

1. Days 1–2: name an owner, check the ICO fee and set up your evidence folder

   Name one person as data protection lead and give them a deadline and authority to ask every colleague questions; most small businesses do not legally need a Data Protection Officer, but someone must own the job. Use the ICO's online self-assessment for the data protection fee: if you process personal data electronically, you must normally pay unless every use falls within the exemptions, such as staff administration, accounts and advertising your own business. If you use CCTV for crime prevention or hold data for other purposes, the exemption usually falls away, so check rather than assume. Pay the correct tier based on staff numbers and turnover, check the current fee on the ICO website, and set a renewal reminder, because the ICO can issue penalties for not paying. Create a folder called 'Data protection evidence' with sub-folders for the data map, notices, supplier contracts, breaches, requests, complaints and training; the ICO expects you to show your work, not just do it.