Step #16 of my Top 20 Tips for Small Business Start Ups has a reputation for causing panic as well as glazing over. Heard the term GDPR? Heard of data permissions? It sounds like a minefield, but the basics are very manageable once someone explains them in plain English. So here we go.
If you collect, store or use information about people, such as names, email addresses, phone numbers or photos, you're handling personal data. That includes your customers' details, people on your mailing list, your enquiry forms, and even a spreadsheet of contacts. So almost every business is included in this, including sole traders.
In the UK, the rules are set out in UK GDPR and related laws, and the regulator is the Information Commissioner's Office (ICO). The ICO has a dedicated hub of advice for small and medium organisations, including start-ups and sole traders, with self-serve tools to get answers to your questions and generate tailored advice, plus bitesize guidance.
The basics in plain English
Broadly, the law asks you to treat people's data the way you'd want yours treated. The ICO's UK GDPR guidance goes into detail, but the principles boil down to this:
1. Be fair and open. Have a good reason for using data, and tell people what you're doing with it.
2. Use it for a clear purpose. Don't collect details for one reason and use them for something else.
3. Only collect what you need. If you don't need someone's DoB, don't ask for it.
4. Keep it accurate. Correct mistakes and update details.
5. Don't keep it forever. Delete data safely when you no longer need it.
6. Keep it safe. Protect it from loss, theft and accidents.
7. Take responsibility. Be able to show you're following the rules.
1: Do a quick data audit
Ask yourself:
• What personal data do I collect? This may be customers, enquiries, suppliers, newsletter subscribers, survey respondents (remember the survey you ran in Step #2!).
• Why do I need it?
• Where is it stored? Spreadsheets, your phone, email, accounting software, a CRM, paper notes.
• Who can or could see it?
• How long do I need to keep it?
A simple table does the job, and it's the foundation for everything else.
2: Tell people what you're doing
You'll need a privacy notice (sometimes called a privacy policy) on your website and wherever you collect data. It should explain, in plain language, who you are, what you collect, why, who you share it with, how long you keep it and how people can exercise their rights. The ICO's small business tools can help you generate one.
3: Get your marketing permissions right
This is the bit most relevant to my world, so listen up. If you want to send people marketing emails or texts, there are specific rules, separate to UK GDPR, about consent. The ICO's guidance on direct marketing explains them. In general:
• Don't buy a list and email it. That's a quick way into trouble.
• Make consent clear and active. No pre-ticked boxes, and make it obvious what people are signing up to, such as a weekly newsletter.
• Keep a record of when and how someone opted in. Your email platform will probably do this for you.
• Make it easy to unsubscribe, and honour requests quickly. Again your email platform will do this automatically.
• Know the exceptions. There's a limited route for contacting existing customers about similar products in certain circumstances, so check the ICO guidance before relying on it.
If you use an email platform, check its settings. It will make consent and unsubscribing straightforward.
4: Know what people can ask of you
Individuals have rights over their data, including asking to see what you hold on them, asking you to correct it and, in some situations, asking you to delete it. Have a simple process so that if someone emails you, you know what to do and who handles it.
5: Keep data secure
Most data problems start with something mundane: a lost laptop, a phishing email, an email sent to the wrong person. Basics that make a big difference:
• Use strong, unique passwords and a password manager.
• Turn on two-step verification for important accounts.
• Keep devices and software up to date.
• Back up your files.
• Be careful about who you share data with.
The National Cyber Security Centre's small organisations guide to cyber security walks you through these step by step.
6: Have a plan for when things go wrong
If you lose personal data, or it's accessed by someone who shouldn't see it, you may need to tell the ICO and the people affected. Decide in advance who handles it, and keep the ICO's guidance bookmarked.
What about your website?
If you use cookies or similar tools that aren't strictly necessary (like some analytics and advertising tools), there are rules about getting consent. We'll come back to this in Step #18 when we look at building your website.
Do I need to pay the ICO?
Some larger organisations that handle personal data are required to pay a data protection fee to the ICO, though some are exempt. The ICO website has a way to check whether you need to pay, so do that early. You can find the tools in its advice for small organisations.
Don't let it scare you
The point of data protection isn't to catch small businesses out. Following the basics, being honest with people and keeping things tidy puts you ahead of many. It also builds trust, which is great for your brand.
Actions to take from this
Don't panic, you don't have to do everything today!
• ☐ List the personal data you collect and where it lives
• ☐ Use the ICO's tools to check whether you need to pay the data protection fee
• ☐ Draft a privacy notice
• ☐ Check how your sign-up forms collect consent
• ☐ Work through the NCSC cyber security guide
Need help with marketing permissions?
I can help you build a mailing list that's both effective and above board. Book a call with me here.
Next up in the series: Step #17, Marketing Your Business. My favourite bit, obvs!
