GDPR Checklist for Small Businesses UK (2026)

If your business holds a single customer email address, GDPR applies to you. There is no exemption for being small, no turnover floor, no staff threshold. A sole trader with 40 people on a mailing list has the same core duties as a company with 400 staff.

The law comes down to a few habits: know what data you hold, tell people what you do with it, keep it secure and delete it when you no longer need it. Several details changed in 2026, when the Data (Use and Access) Act 2025 amended UK GDPR, the Data Protection Act 2018 and the rules on cookies and marketing emails. Its main provisions took effect on 5 February 2026, with a new complaints duty following on 19 June 2026.

What changed in 2026

The Act does not replace UK GDPR. It tweaks it, and a couple of changes make life easier.

Data flows to Europe are unaffected. In December 2025 the EU renewed its decision that the UK protects personal data properly, so information can keep flowing until December 2031.

The 12-step GDPR checklist

Work through these steps in order.

1. Map the personal data you hold

For each type of personal data, note where it comes from, where it is stored and who you share it with. Customer names and email addresses, staff payroll records, supplier contacts, CCTV footage and your email marketing list all count.

2. Give every use a lawful basis

Every use of personal data needs one of seven lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests and the new recognised legitimate interests. Most small businesses lean on three: contract for orders, legal obligation for payroll and VAT records, and legitimate interests for security and fraud prevention. If you cannot name a basis for a use, stop doing it until you can.

3. Write a clear privacy notice

This is the part most small businesses miss. You must tell people who you are, what you collect, why you collect it, the lawful basis, who receives it, how long you keep it and what rights they have. Put the notice on your website, link it from the footer of every page and from every form.

4. Sort out your website and cookies

Check every form, analytics tool and embedded widget against your privacy notice. Since 5 February 2026, cookies used only to count visits or remember site preferences can be set without prior consent, as long as you explain them and offer a simple, free opt-out. Advertising cookies and most third-party tracking still need consent first.

5. Fix your marketing lists

Marketing email is where the ICO receives the most complaints, and fines for marketing breaches can now reach £17.5 million or 4% of turnover. Only email people who have opted in, with an unticked box, and give them an unsubscribe link in every message. Never add contact form enquirers to a marketing list automatically. Keep a record of when and how each person consented.

6. Get staff data right

Staff files are personal data too, and they are usually the most sensitive data a small business holds: bank details, National Insurance numbers, health information and disciplinary records. Only collect what you need, keep it in one secure place, and limit access to those who need it. Tell staff what you hold in a staff privacy notice, separate from the website version. CCTV needs a clear reason, visible signs and a retention period of no more than 30 days. See our guide to essential HR policies for UK small businesses for more on staff data policies.

7. Lock the data down

UK GDPR requires appropriate technical and organisational measures to protect personal data. In plain terms: strong passwords, two-factor authentication, prompt software updates, and access limited to those who need it. Most small business data incidents start with a phishing email or a file sent to the wrong address. Our cyber security checklist for UK small businesses walks through the practical steps, and the Cyber Essentials certification guide explains the scheme many clients now ask suppliers to hold.

8. Set retention periods

Personal data should be kept no longer than necessary. The law sets no fixed periods, so decide them and write them down. A workable starting point: six years for invoices and tax records, one year for unsuccessful job applications, and three months for website enquiry forms that lead nowhere. Set a calendar reminder to delete data that has passed its date. Old data is a liability: it is the data most likely to be caught in a breach.

9. Put contracts in place with suppliers

Anyone who processes personal data for you is a processor, and you need a written contract with each one under Article 28 of UK GDPR. That includes your accountant, payroll provider, email platform, cloud storage provider and website host. Most reputable providers already have standard data processing terms, so this step is often a matter of checking the terms exist and saving a copy. Check also where your suppliers store data, because transfers outside the UK need an approved safeguard.

10. Pay the ICO data protection fee

Most organisations that use personal data must pay an annual fee to the regulator unless exempt. The ICO has a free fee checker that takes a few minutes.

Sole traders are not automatically exempt, so check rather than assume.

11. Answer requests and complaints on time

People can ask for a copy of the personal data you hold, and you normally have one month to respond. The 2026 changes help here: your searches only need to be reasonable and proportionate, and you can pause the clock while you ask the person to clarify what they want. The new duty is about complaints. Since 19 June 2026, you must give people a way to complain about how you use their data, acknowledge each complaint within 30 days, look into it and tell the person the outcome.

12. Plan for a data breach

A breach is not a question of if but when, and the firms that cope best are the ones that planned in advance. Decide now who takes charge and who needs to be told. If a breach is likely to risk people’s rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it. If the risk is high, you must also tell the people affected, in plain language and without undue delay. Backups are part of breach planning too. Our guide to the 3-2-1 backup rule for small businesses sets out a simple system that works for a firm of any size.

What happens if you get it wrong

The headline fines are large, but context matters. The ICO’s enforcement focuses on bigger offenders, and small businesses very rarely face a maximum fine. What small firms do face is enforcement notices and the cost of putting things right under pressure.

The realistic risk for a small business is not a seven-figure fine. It is a customer complaint, a lost contract because a client asked for your privacy policy and you did not have one, or a week of disruption after a preventable incident.

Your first-week action plan

If you do nothing else, do these five things this week.

Work through the remaining steps at your own pace, and review the checklist every six months.

This guide is general information, not legal advice. For health records, children’s data or large-scale monitoring, speak to a data protection specialist.