If your business holds personal details about customers, staff or suppliers, UK data protection law applies to you — and most businesses also have to register with the Information Commissioner's Office and pay an annual data protection fee, £52 for most small businesses, though some are exempt. For a one-person business the practical work is an afternoon: know what you hold and why, write a short privacy notice, keep it secure, and delete it when you are done with it.
At a glance
| Feature | Detail |
|---|---|
| Who the ICO is | The UK's data protection regulator — the body you register with |
| Who must register | Most organisations processing personal information, with exemptions |
| The fee | £52 a year for most small businesses, in tiers by size |
| What the law asks | Know what you hold, why and for how long; tell people; keep it safe; delete it |
| Marketing rules | Separate rules for email and texts — consent, and an unsubscribe every time |
| If data is lost | Some breaches must be reported to the ICO quickly |
| Where to check | ico.org.uk — the ICO publishes free guides for small businesses |
What the ICO is
The Information Commissioner's Office is the UK body responsible for data protection. It keeps the register of organisations that handle personal information, collects the annual data protection fee, publishes guidance, and investigates complaints.
Personal information — the law calls it personal data — means anything that identifies a living person. A customer's name and phone number counts. So does a delivery address, a photograph of someone, a job applicant's CV, an employee's bank details, and the list of email addresses you send offers to.
Almost every business holds some. That is normal, and the ICO's own guidance for small businesses is written to be readable rather than legalistic. This page is a plain explanation of how it works, not legal advice.
Who has to register and pay the fee
Registration is a short online form and an annual payment. The fee sits in tiers based on the size of the organisation and the number of staff, with the smallest tier aimed at exactly the kind of business reading this.
Some organisations are exempt — historically this has covered things like processing only for staff administration, only for your own accounts and records, or only for advertising your own goods and services, and there are exemptions for some not-for-profits. The exemptions are narrower than people assume, and using a CCTV camera or storing customer records electronically often takes a business outside them.
The reliable way to find out is the ICO's own self-assessment tool on ico.org.uk — a handful of questions, a straight answer, free. Do it rather than guessing, because being registered when you did not need to be costs a small fee, and not being registered when you should be is an offence.
One thing worth knowing: being exempt from the fee does not exempt you from the rules. The duties below apply either way.
What UK GDPR actually asks of a one-person business
Strip out the language and it comes down to six things.
1. Know what you hold, why, where, and for how long. Sit down for half an hour and write the list: customer names and numbers in your phone, quotes in your email, an invoicing app, a spreadsheet of leads, photographs of jobs, staff records if you have staff. Next to each one, write why you have it and how long you will keep it. That list is most of the work, and it is the thing you will be asked for if anyone ever queries you.
2. Have a reason for holding it. In practice, for a small business, that reason is usually one of: you need it to do the job the customer asked for, you have to keep it for tax or another law, or the person agreed to it. Marketing lists are the one that trips people up, and the section below covers those.
3. Tell people, in a privacy notice. This is a short piece of plain writing on your website, or handed over on paper if you do not have one. It says who you are, what you collect, why, who else sees it, how long you keep it, and how someone can ask for a copy or ask you to delete it. It does not need to be long, and copying a generic one from the internet is worse than writing four honest paragraphs about what you actually do. Our website guide covers where it belongs on the page.
4. Keep it secure. For most one-person businesses this means: a passcode and a decent password on the phone and laptop, two-factor authentication on email, not emailing spreadsheets of customer details around, and not leaving paperwork in the van. It is basic housekeeping, not a security project.
5. Delete it when you are done. Old customer lists you will never use again are a liability with no upside. Set a rough rule — for example, keep customer records for as long as tax rules require and delete marketing contacts who have gone quiet — and actually follow it.
6. Answer a subject access request. Anyone can ask what personal information you hold about them, and you have to give them a copy, usually free and within a set time limit. In a small business this is rare and usually simple: search your email and your invoicing system for their name, put what you find in a document, send it. If you have kept the list from point one, you already know where to look.
Marketing by email and text
Sending marketing is governed by a second set of rules — the Privacy and Electronic Communications Regulations, usually shortened to PECR — and they sit on top of everything above. They are the ones the ICO fines small businesses over most often.
The plain version:
- Consumers need to have agreed before you send them marketing emails or texts. A pre-ticked box is not agreement, and neither is a business card handed over at a networking event.
- There is a narrow exception for people who have bought from you, sometimes called the soft opt-in: you can market similar things to your own customers if you gave them a clear chance to say no when you took their details, and every message since has offered an easy way out.
- Business-to-business email is treated more leniently than marketing to consumers, but the rules still apply and sole traders and some partnerships are treated as individuals.
- Every marketing message needs a clear unsubscribe, and you must act on it promptly.
- Buying a list is where small businesses get into trouble. You are responsible for whether those people agreed, and "the seller said they had" is not a defence.
Keep a note of when and how each person agreed. A date and a source next to the email address is enough, and it is the evidence you would need. If you want the wider picture of what actually brings customers in, our guide to marketing a small business covers the channels in the order they usually pay.
What to do if you lose data
A laptop goes missing, an email with a customer list goes to the wrong person, an account gets hacked. It happens to careful people.
Work through it in this order. Contain it — change passwords, remotely wipe the device, recall or ask the recipient to delete the email. Write down what happened, when you found out, what information was involved and roughly how many people. Decide whether it needs reporting. Not every incident does: the test is whether it is likely to risk people's rights and freedoms, which in plain terms means whether real harm could come to them. Where it does, the ICO must be told within a set deadline from when you became aware, and where the risk to individuals is high you also have to tell the people affected.
Keep your own record of every incident, including the ones you decided not to report and why. That record is a normal expectation, and it is much easier to write on the day than a year later.
None of this is a reason to be nervous about holding customer details. It is a reason to know where they are.
What this looks like in practice
Take Jamie, who runs a one-man plumbing business in Reading. He holds more personal information than he thinks: several hundred customer names, phone numbers and addresses in his phone, three years of quotes and invoices in his email, a booking app with job notes, photographs of work inside people's homes, and a spreadsheet of everyone who has ever asked for a quote.
His afternoon of admin looks like this. He writes the list above, with a reason and a keep-it-for period next to each line. He checks the ICO self-assessment and, because he stores customer records electronically for more than his own accounts, he registers and pays the annual fee of £52, £5 less if he sets up the direct debit. He writes four paragraphs of privacy notice for the contact form on his one-page website. He turns on two-factor authentication for his email and puts a passcode on the work phone. He deletes the quote spreadsheet rows older than three years. And he stops texting old customers offers unless they said yes, adding a line to his job sheet asking whether they want occasional reminders.
Total cost: the annual fee, and an afternoon. Both are small, both are ongoing, and both belong in the running costs of the business rather than as a surprise.
Create a mini business plan in minutes with Plan.business. Put in your rate, your hours and your costs, and it works out the rest — what you will make, when you break even, and what you need to charge to hit your target.
Frequently asked questions
Do I need to register with the ICO as a sole trader? Often yes. Registration depends on what you do with personal information, not on your business structure, and holding customer records electronically usually brings you in. Some exemptions exist. Use the free self-assessment on ico.org.uk to get a straight answer for your situation.
How much is the ICO data protection fee? It is an annual fee set in tiers according to the size of the organisation, with the lowest tier intended for small businesses. Paying by direct debit has historically attracted a small discount. Check the current figure on the ICO website before you pay.
What happens if I do not register with the ICO? Failing to pay the fee when you are required to is an offence and can lead to a penalty. The ICO generally contacts businesses before taking action. Registering late is straightforward, so if you have been trading a while and have only just realised, simply do it.
Do I need a privacy policy on my website? If you collect any personal details through your site — a contact form, a booking, an email signup — then yes, you need a privacy notice explaining what you collect, why, how long you keep it and how someone can ask for a copy or deletion. Four honest paragraphs about what you actually do beats a copied template.
Can I email past customers with offers? Usually yes, under the soft opt-in: you may market similar goods or services to people who have bought from you, if you gave them a clear chance to opt out when you took their details and every message since includes an easy unsubscribe. People who only ever asked for a quote need to have agreed.
Figures correct as of September 2026. Tax thresholds, fees and rates change; check the linked GOV.UK pages before acting. Prices and costs shown are indicative and vary by area and by what's included.
What is Plan?
Plan is a free business operating system for people starting or newly running a UK business. It walks you, one simple step at a time, from your elevator pitch through brand, product and pricing, to a complete business plan — then uses everything it now knows about the business to help with the basics: logo and brand, marketing, a website, a bank account, funding, insurance, company registration. You can use as much or as little as you want.
Two ways to do this
Get the admin on a list, free. Plan works out which setup and compliance jobs apply to the business you are actually starting, and puts their costs into your numbers so the annual fees are expected rather than annoying. It runs in your browser and you can use just this part.
Or have the website side handled. The forms, the privacy notice and the cookie banner all live on your site, and our sister agency The Fractions build websites for small UK businesses, including the bit that turns visitors into enquiries.