Legal & Compliance
GDPR Compliance for Small Businesses
Essential data protection requirements and how to ensure your business is GDPR compliant.
By Free Business Registration Ltd · 1 min read
Businesses handling personal data must consider their obligations under UK data protection law. Start by documenting what you collect, why you need it, how you protect it and how people can exercise their rights. Use the ICO’s current guidance for your circumstances.
Key GDPR Principles
- Lawfulness, fairness and transparency
- Purpose limitation - collect for specified purposes
- Data minimisation - only collect what's needed
- Accuracy - keep data up to date
- Storage limitation - don't keep longer than necessary
- Integrity and confidentiality - ensure security
- Accountability - be able to demonstrate compliance
Legal Basis for Processing
- Consent - freely given, specific, informed
- Contract - necessary for contract performance
- Legal obligation - required by law
- Vital interests - protect someone's life
- Public task - official functions
- Legitimate interests - balanced against rights
Required Documentation
- Privacy policy on website and forms
- Record of processing activities
- Data protection impact assessments (if high risk)
- Breach notification procedures
- Subject access request procedures
- Staff training records
Official guidance
This is general guidance. Check the current official rules and get advice for your circumstances before making tax, legal or financial decisions.