GDPR for small businesses: what you actually need to do

What does GDPR require from a small business?

The GDPR applies across the EU, and the UK has its own almost identical version, the UK GDPR, overseen by the Information Commissioner’s Office (ICO). Both apply to businesses of every size. A name and phone number taken for a booking, an email address for a loyalty scheme, CCTV footage: all of these are personal data.

This guide covers the principles shared by the EU and UK rules, with official sources. Each country has its own regulator and some local rules, so check your regulator’s website for details. For the rules on marketing emails, see our customer retention guide, which already covers them.

What personal data does my business hold?

More than you might think. Walk through your day, from the counter to the phone:

Only collect what you genuinely need. Selling a loaf of bread does not require an email address. Make anything extra optional.

Take care with health information: an allergy or intolerance in a customer record is special category data. Record it only if the customer gave it to you so you could take it into account, and use it for nothing else.

Do I need to register, pay a fee or keep records?

In the UK: the data protection fee

The ICO says that organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt. The amount depends on the size of the business; the ICO website has a quick self-assessment to tell you whether you must pay and how much.

Records of processing

The GDPR asks organisations to keep a written record of what they do with personal data. Businesses with fewer than 250 employees have an exemption, but it is narrow: as the French regulator, the CNIL, explains in its guidance on records, regular processing (such as managing customers and suppliers), risky processing (such as CCTV) and sensitive data (such as health) still have to be recorded. In practice, almost every shop or restaurant should keep one. It can fit on one page:

How do I tell customers what I do with their data?

At the moment you collect data, people must be told who you are, why you need it, who receives it, how long you keep it and what their rights are. The European Commission’s guidance lists the full content, and the ICO’s right to be informed page asks for clear and plain language and suggests short notices at the point of collection, linked to a fuller privacy policy.

A notice to place under a booking form:

The details in this form are used by [Business name] to manage your booking, send you a confirmation and a reminder, and note your preferences (allergies, special occasion) if you share them. Our team and our booking software provider can access them. We keep them for [chosen period, e.g. 3 years after your last visit]. You can ask to see, correct or delete them by emailing [email address]. You also have the right to complain to [your data protection authority, e.g. the ICO].

A notice to display at the till if you keep a paper or tablet customer list:

[Business name] customer list: if you give us your details, we use them only to [tell you when your order is ready / run your loyalty card / send you our news if you agreed]. We never pass them on. You can ask to see, correct or delete them at any time, in store or at [email address].

Your website also needs a legal notice and a privacy policy: our guide to legal pages for a small business website has a template.

How long can I keep customer data?

As long as you need it for the reason you collected it, then delete it or archive it with restricted access if the law requires you to keep it (invoices, for example). Neither the GDPR nor the UK GDPR sets a single period: you decide, and you should be able to explain why.

Regulators publish benchmarks that help. In France, the CNIL’s reference framework for customer management suggests keeping customer data used for marketing for the length of the relationship and then 3 years after it ends, and prospects’ data for 3 years from collection or their last contact (a click on a link in your email counts). It is not binding, but it shows what a regulator considers reasonable.

In practice, book two clear-out sessions a year: inactive customers, old lists, duplicate spreadsheets, old booking books.

A customer asks for their data: what do I do?

Customers can ask to see the data you hold on them, have it corrected or deleted, or stop receiving your messages. The ICO’s guide to subject access says you must respond without undue delay and at the latest within one month; you can extend by up to two more months if the request is complex, telling the person why within the first month. In most cases you cannot charge a fee. The French CNIL gives the same one-month rule.

1. note the date of the request;
2. check it really comes from the person (without asking for more than you need);
3. search everywhere: booking software, spreadsheets, notebooks, mailbox, email tool;
4. reply in writing and keep a copy.

A reply to a deletion request:

Dear [First name], We received your request of [date]. We have deleted your details from our customer records and our mailing list: [name, phone, email, preferences]. We only keep invoices, because the law requires us to. You will not receive any more messages from us. If you have any questions, email us at [email address]. Kind regards, [First name], [Business name]

How do I protect my files and choose providers?

Basic security

• a different password for each tool, and one account per team member rather than a shared login;
• no customer list on a loose USB stick or emailed around as a spreadsheet;
• the booking book put away, not left open on the counter;
• each person sees only what they need.

If something goes wrong

A stolen laptop, a file sent to the wrong person, a hacked account: these are personal data breaches. The ICO’s breach guide says a notifiable breach must be reported within 72 hours of becoming aware of it, people must be told without undue delay if the risk to them is high, and every breach must be recorded internally, even when you do not report it. EU regulators apply the same 72-hour rule.

Your providers

When a provider handles data for you (booking tool, website, till system), it is your processor. You remain responsible, and the GDPR (article 28) requires a contract covering what it does with the data. Choose tools that help you comply: consent collection, automatic unsubscribe links, deletion when the retention period ends, separate access by role, and ask where the data is stored.

With Voxtya, the Bookings service builds your customer file from bookings (regulars, allergies, occasions); Voxtya processes it on your behalf as a processor, and its privacy policy lists its own providers.

What about cookies, emails and CCTV?

Cookies

Under the ICO’s cookie guidance, non-essential cookies need consent through a clear, positive action, with clear information; cookies strictly necessary for the service the visitor asked for are exempt. EU countries apply similar rules. Ask your website provider which cookies the site uses.

Emails

In short: prior consent for marketing emails, except for existing customers offered similar products or services, provided they were told and can unsubscribe easily from every message. Booking confirmations and reminders are service messages. The details are in our customer retention guide and our newsletter guide.

CCTV

The ICO’s video surveillance guidance says surveillance must be lawful, necessary and proportionate, and warns against recording where people would not expect it. In practice: film the entrance, sales floor and till, never changing rooms or toilets; do not use cameras to monitor staff performance; put up clear signs; keep footage only briefly (in France, the CNIL says one month at most in principle); and limit who can view it. Some countries require an authorisation for cameras covering areas open to the public, as France does.

What should I watch for in my type of business?

• Restaurants: allergies in bookings are health data; keep them only to serve the customer and protect the file. Paper booking books must be stored and destroyed after your chosen period. See Voxtya for restaurants.
• Hair and beauty salons: client cards (colour formulas, skin reactions) may contain health information; keep only what is useful. Before-and-after photos need the client’s consent.
• Shops and wine merchants: a digital loyalty card means collecting an email or phone number; a stamp card needs none.
• Bakeries: cake order details can be deleted once the order is collected and paid, apart from the invoice.
• Tradespeople: quotes and invoices hold customers’ home addresses; keep invoices as tax rules require, but rejected quotes do not need to be kept as long.
• B&Bs and guesthouses: check any guest registration rules in your country, and do not keep copies of ID documents beyond what is required.

What mistakes should I avoid, and where do I start?

• a catch-all customer file never cleaned, with customers from ten years ago;
• rude comments about a customer in a record (they can ask to see it);
• a single shared login for the whole team;
• a camera filming an employee’s workstation all day;
• a pre-ticked marketing box;
• no privacy notice under website forms.

Checklist:

• I have listed the data I collect and why
• I keep a one-page record of processing
• UK: I have checked whether I must pay the ICO fee
• Every form has a short notice and a link to the privacy policy
• I have set a retention period for each file
• I clear out my files twice a year
• Each team member has their own login and a strong password
• I can answer a customer request within one month
• My providers have a contract covering data
• My cameras are signposted and footage is not kept too long

The steps at a glance

Simple steps for a small business to follow EU or UK data protection rules without spending weeks on it.

1. Take stock. List where you collect data: bookings, customer records, emails, quotes, CCTV, staff.
2. Cut back. Delete what you do not need and make anything non-essential optional.
3. Check registration. In the UK, check whether you must pay the ICO data protection fee.
4. Keep a record. Write one line per activity: data, purpose, access, retention.
5. Inform people. Add a short notice under each form and a privacy policy on your website.
6. Set retention periods. Pick a period for each file, using your regulator’s benchmarks.
7. Secure and check providers. One login per person, strong passwords, a contract with each provider.
8. Clear out regularly. Twice a year, delete what has passed its retention period.

This guide for your trade

• Restaurants
• Hair and beauty salons
• Shops
• Bakeries
• Hotels and B&Bs

Go further

• Legal pages for a small business website
• Customer retention (and email rules)
• Email newsletters for small businesses
• Online booking with no commission
• Google reviews and GDPR for medical practices
• Best restaurant CRM: tools compared