This is general information about UK rules, checked on the date above. It is not legal advice, and rules change. For a decision that matters, check the sources below or ask a qualified adviser.
UK GDPR can sound like something for large companies with legal teams, but it also applies to a sole trader keeping customers’ phone numbers. The good news is that for most small businesses it comes down to common sense, written down. Here is what matters most.
The short version
- Most organisations that use personal information, including sole traders, must pay a data protection fee unless exempt.1
- The fee is £52 or £78 for most small organisations.2
- You must tell people what you do with their data.3
- Some data breaches must be reported to the ICO within 72 hours.4
The seven principles
The ICO sets out the principles at the heart of UK GDPR.5 Here they are, with our plain-English reading of each.
| Principle | In plain English |
|---|---|
| Lawfulness, fairness and transparency | Have a good reason, be fair and tell people |
| Purpose limitation | Do not use data for something unrelated to why you collected it |
| Data minimisation | Only collect what you need |
| Accuracy | Keep it correct, and fix mistakes |
| Storage limitation | Do not keep it forever |
| Integrity and confidentiality | Keep it secure |
| Accountability | Be able to show you do all of the above |
Pay the fee
Under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt.1 The annual fee depends on your size and turnover. It is £52 or £78 for most organisations, including small and medium-sized businesses, and can be up to £3,763 for large ones.2
The ICO offers a short self-assessment to check whether you need to pay.6
Tell people what you do
You must give individuals information including your purposes for processing their data, how long you will keep it and who it will be shared with. You must provide it when you collect their data. If you get it from elsewhere, you must provide it within a reasonable period, no later than one month.3
That is what a privacy notice is for. A short, honest one is better than a long template full of things that do not apply to you. Our guide to what a UK website must show covers where it should go.
Know your data
You cannot protect data you do not know you have. Our suggestion is to spend an hour writing a simple list:
| What | Where it lives | Why you keep it | When you delete it |
|---|---|---|---|
| Customer names and numbers | Phone, job system | To do the work | Set a date |
| Enquiries | Email, website | To reply | Set a date |
| Staff records | Files, payroll | Legal duties | See employee records |
| Accounting records | Accounting software | Tax | See business records |
This simple table also shows you where the risks are, such as customer details on an old phone.
When something goes wrong
If you have a personal data breach, you may need to report it to the ICO. It offers a self-assessment tool to help you decide, and a simple guide for small companies and sole traders on how to respond in the first 72 hours.4
The ICO recognises you may not have the full picture within 72 hours, especially if a breach is complex or ongoing. You are still legally required to meet this timeframe, and should provide what you have, adding further details later without undue delay.4
A breach includes more ordinary mistakes than people expect. An email sent to the wrong person, a lost phone or a shared spreadsheet with too many people on it can all count. Afterwards, the ICO says you should always reflect on lessons learned.4
Marketing has extra rules
Separate rules apply to marketing emails and texts, and these catch out many small businesses, particularly when contacting sole traders. See our guide to UK email marketing rules.
The small changes that cover most of it
These are our practical suggestions:
- Use a password manager and two-step sign-in on email and business accounts. Email is often the key to everything else.
- Stop collecting what you do not need. A date of birth on an enquiry form is a liability with no benefit.
- Keep customer data out of personal apps, including personal WhatsApp where you can.
- Set deletion dates and actually keep to them.
- Restrict access, so staff see only what they need for their job.
- Write down what you decided and why. That is what accountability means in practice.
Security and data protection go together. Our article on Cyber Essentials covers the technical basics.
The ICO can help
The ICO’s pages for small organisations include self-serve tools and short guidance for small businesses, start-ups and sole traders.7 They are written for people without a legal team, so start there before paying for a template pack.
If you hold a lot of customer data across scattered spreadsheets, bringing it into one controlled place can reduce your risk as well as your workload. That is part of our data and automation work.
Sources
-
Information Commissioner’s Office, Data protection fee, accessed 7 November 2026. ↩ ↩2
-
GOV.UK, Pay the data protection fee: how much it costs, accessed 7 November 2026. ↩ ↩2
-
Information Commissioner’s Office, The right to be informed, accessed 7 November 2026. ↩ ↩2
-
Information Commissioner’s Office, UK GDPR data breach reporting, accessed 7 November 2026. ↩ ↩2 ↩3 ↩4
-
Information Commissioner’s Office, A guide to the data protection principles, accessed 7 November 2026. ↩
-
Information Commissioner’s Office, Data protection fee self assessment, accessed 7 November 2026. ↩
-
Information Commissioner’s Office, Advice for small and medium organisations, accessed 7 November 2026. ↩
Data and automation
Less copying between systems, fewer spreadsheet errors, and reports you can believe.
See how it works