Privacy work feels like paperwork until the day a customer asks what you hold about them, or a supplier leaks a list, or a form collects more than it should. Small businesses rarely need a privacy department. They need six short documents, written plainly, kept current, and known to the people who handle customer data.

Anything that identifies a person, alone or in combination: names, emails, phone numbers, addresses, order histories, IP addresses, photographs, and notes from a support call. Business contact details for a sole trader are usually personal data too, which surprises people.

Special categories, such as health information, require more care. If you do not need it, do not collect it. The safest privacy control is a field that was never added to the form.

Know what you hold, and where it lives

List every place personal data enters the business: the website form, the checkout, the inbox, the phone, the shop diary, the spreadsheet, the accountant's shared folder. For each, note what is collected, why, where it is stored, who can see it, and how long it is kept.

One page is enough for most small businesses. The value is not the document; it is discovering that three people have their own copy of the customer list.

The privacy notice, written to be read

A privacy notice should say what you collect, why, who you share it with, how long you keep it, and how someone can ask for a copy or deletion. Plain sentences, headings, no clause numbers.

Link it where data is collected, not only in the footer. A checkout that asks for a phone number should explain why in one line beside the field, and the notice should match that explanation. Most complaints about privacy come from a mismatch between what the form implies and what the notice says.

A privacy notice nobody can finish reading is not transparency. It is a legal formality wearing a plain-language costume.

Set retention rules you actually follow

Decide how long each category is kept: orders for accounting, enquiries for a year, marketing contacts until they unsubscribe or after a defined period of inactivity. Write the rule down, then delete on schedule.

Keeping everything forever is the default and the riskiest option. It turns a small breach into a large one and makes every data request harder to answer.

Every tool that touches customer data is a supplier: email platform, payment provider, courier, booking system, accountant, freelance developer. List them, note what data they receive, and check that each has terms covering confidentiality and security.

When a tool changes or a contract ends, remove the data and the access. Dormant accounts with old exports are a common and avoidable exposure.

Keep a record of how each contact was added: which form, what wording, what date. Consent must be a clear action, not a pre-ticked box, and every marketing email needs a working unsubscribe link that takes effect promptly.

Transactional messages, such as order confirmations, are separate from marketing. Do not use them as a back door to add people to a newsletter.

The wording of that consent is where UK law parts company with the EU templates most signup forms are copied from. GDPR vs UK GDPR for a newsletter covers the differences that matter for a small list.

Have a breach plan

Write one page: who to call, what to record, how to contain the issue, who decides whether to notify customers, and where the legal obligation sits in your jurisdiction. Check the specific rules that apply to you rather than assuming.

A plan written on a calm day is worth more than a perfect plan written after an incident has started.

Handling requests from customers

People may ask what you hold, ask for a copy, ask for correction, or ask for deletion. Have a process: verify identity, gather the data from every system on the map, respond within the legal deadline, and record what was done. One hour of preparation makes this a routine task rather than a panic.

Documentation checklist

  • One-page data map covering every collection point and system.
  • Privacy notice linked at every form, written in plain language.
  • Retention rule per data category, with a deletion habit.
  • Vendor list with data shared and contract status.
  • Consent record showing source, wording, and date.
  • One-page breach plan with named responsibilities.
  • A named owner who reviews all of it twice a year.

None of this requires a consultant. It requires an afternoon, a shared folder, and a review date that someone actually keeps.