Small Business Research and Enterprise

By Michael Buckworth, managing partner at Buckworths

In the UK, the Data Protection Act 2018 (the “DPA”) (which incorporates GDPR into English law) sets out the primary obligations of businesses when processing personal data. The regulator is the Information Commissioner’s Office (ICO) which has wide enforcement powers including the ability to impose fines and public censure.

The good news? Compliance is manageable if approached methodically.

Here are five practical steps to help your startup nail data protection compliance.

1. Map your personal data

You cannot protect what you do not understand. Start by mapping:

• what personal data you collect (e.g. names, emails, IP addresses, employee data);
• where it comes from (website forms, app analytics, third parties);
• why you collect it (sales, marketing, service delivery, HR);
• where it is stored (CRM, cloud hosting, spreadsheets); and
• who you share it with (processors, partners, overseas providers).

Mapping what you do with personal data frequently reveals risks including duplicated data, unnecessary data retention and tools that may be using your personal data for purposes of which you were not aware. These issues can be addressed early before they become problems identified by investors in your funding round, customers in the course of contract negotiations or data subjects.

2. Identify your lawful bases

Under the DPA, every processing activity must have a lawful basis. The most commonly used bases are as follows:

Contract – where processing is necessary to perform a contract (e.g. providing your SaaS service).

Legitimate interests – where you have a genuine business interest that is not overridden by individuals’ rights.

Consent – typically required for certain marketing activities, especially electronic marketing.

Legal obligation – for compliance with tax, employment, or regulatory duties.

A common mistake is over-reliance on consent. If you can rely on contract or legitimate interests, it is generally better to do so as a separate opt-in consent must be given for every single processing activity for which you intend to use consent as the lawful basis.

3. Get your documents and contracts in order

Compliance is not just operational – it is documentary. At a minimum, most start-ups will need a compliant privacy policy; an employee privacy notice; a data retention policy; and data processing agreements with suppliers

If you use third-party providers (e.g. cloud hosting, payment processors, CRM systems), you are likely the “controller” and they are your “processor”. The arrangements you have with your processors need to be documented in writing.

International transfers require particular care. If you transfer personal data outside the UK you must ensure appropriate safeguards are in place.

4. Privacy by design

Data protection compliance should not be an afterthought. The DPA requires “data protection by design and by default”. In practical terms, this means that you should collect only the data you genuinely need (data minimisation), use default settings that are privacy-friendly, limit access to personal data internally (role-based access controls), encrypt or pseudonymise data where appropriate and regularly test your security measures.

Embedding privacy early, reduces the risk of expensive redesigns later. It also signals maturity to enterprise customers who will often send detailed security and data protection questionnaires before signing contracts.

5. Prepare for breaches and data subject rights

Even well-run startups experience incidents. What matters is how you respond. Under the DPA, certain personal data breaches must be reported to the ICO within 72 hours of becoming aware of them. Some breaches must also be communicated to affected individuals.

From time to time data subjects may exercise the rights granted to them in the DPA. In most cases, you have one month to respond to requests to exercise rights. Failing to handle these requests properly is a common trigger for complaints to the ICO.

The Data Use and Access Act 2025 (“DUAA”)

The DUAA became law in the UK in 2025 and adds increased protection by giving the ICO enhanced powers, which can include significant financial penalties. In order to ensure your compliance with DUAA you should be thinking about the following:

• how your business will assist those who make data protection complaints.
• should your business operate a service often used by children, ensure measures are in place to consider their needs when processing personal data. 

NEXT STEPS

---

*We strive to do our best when supporting small business and their growth. Our business databases can give you information and data that can help you with advertising, market research, company information, and industry factsheets. If you have already taken the plunge, we would love for you to join us at a seminar, our workshops cover digital marketing, business model canvas and planning, demystifying taxes and intellectual property to name a few. Visit our events page or website for more information.