GDPR for UK Sole Traders: A Practical Guide to What You Need to Know
Most people switch off at the first mention of data protection and plenty of sole traders and small business owners assume it doesn't really apply to them anyway, so there's no point worrying about it. Unfortunately, that isn't the case - if you handle personal information as part of running your business that means you have data protection responsibilities, however small your business might be.
The good news is that GDPR doesn't have to be complicated or expensive. Once you understand the basics, there are some straightforward steps you can take to protect your customers, your business and your reputation.
What is GDPR?
GDPR stands for General Data Protection Regulation and it’s the European Union’s data protection law, which came into force in May 2018. Following Brexit, the UK retained its own version, known as the UK GDPR, alongside the Data Protection Act 2018 and other relevant legislation. Both were updated by the Data (Use and Access) Act 2025, with most of the changes coming into force during 2026. The core principles in this guide haven't changed - in simple terms these laws protect people's personal information and give them rights over how it is collected, used and stored.
Personal data is any information that identifies, or can be used to identify, an individual. This includes the obvious such as names, telephone numbers, email addresses and home addresses, and the not so obvious such as booking details and identifiable photographs. It doesn't just mean information held on a computer either. The names and numbers in your phone, messages in WhatsApp, emails, spreadsheets, paper diaries and address books can all contain personal data. And it's not just your customers' information you need to consider - details relating to suppliers, employees, subcontractors and prospective customers can also fall within the rules.
Does GDPR apply to me?
If you collect or use personal information for your business, you will generally have data protection responsibilities - even a sole trader who just keeps minimal details, like a customer's name, address and telephone number, needs to think about how that information is used and protected. Of course, the amount and type of information you hold will affect the measures you need to take. A sole trader with a small customer list will have different requirements from a business handling large volumes of sensitive information. But being a one-person business doesn't automatically exempt you from the law.
The ICO: registration and fees
The Information Commission's Office (ICO) is the UK's independent data protection regulator and its website is an excellent starting point for understanding your responsibilities. You will likely need to pay the ICO's data protection fee, which is a separate requirement from complying with GDPR, and exemptions apply to some organisations. If you haven’t already registered, head over to the ICO website when you’ve finished reading this article and take their free self-assessment questionnaire, which will tell you whether you need to pay a fee. If you do, you can register and pay online.
For sole traders and smaller businesses the annual fee is £52 or £78, depending on the applicable tier, with a £5 reduction for paying by direct debit. These figures are correct as of October 2026, so check the current amounts on the ICO website before paying. And bear in mind that paying the fee doesn't make your business GDPR-compliant by itself, you still need to handle personal information properly.
How to handle personal information as a sole trader
The main principles are straightforward and should align with how you already run your business: be transparent about what you do with personal information, only collect what you need, use it for legitimate purposes and keep it secure.
Here are the essentials.
1. Know what information you collect and why
Start by making a list of the personal information your business holds including customer contact details, enquiries, quotes, bookings, invoices, payment records, email addresses and notes about jobs. If you have a website, you may also collect information through contact forms, cookies and analytics tools.
For each type of information, ask yourself:
Why do I need it?
Where is it stored?
Who can access it?
How long do I need to keep it?
Only collect information you genuinely need. For example, a dog walker might need a client's address, telephone number and emergency contact details, but there's no reason to collect additional personal information without a good reason.
2. Make sure you have a lawful reason for using it
You need a lawful basis for processing personal data. There are seven possible reasons under the UK GDPR, and the reason you collect this data should be one of them. For most sole traders, the common examples include:
Contract: using a customer's details to provide a service or fulfil a booking.
Legal obligation: keeping records you are legally required to retain.
Legitimate interests: using information for a necessary business purpose where the person's interests and rights do not override yours.
Consent: where someone freely agrees to a specific use of their information.
You don't need consent for everything, but equally, having someone's contact details doesn't give you permission to use them for any purpose you like.
3. Have a privacy notice
A privacy notice, also known as a privacy policy, explains how your business uses personal information. Generally speaking, if you collect personal data you will need to explain the uses to the people concerned. It should be easy to find and written in plain English – my privacy policy is in the footer of every page of my website. Check it out if you want to see a working example of what I mean.
Your notice should explain:
Who you are and how to contact you.
What personal information you collect and why.
Your lawful basis for using it.
Who you share it with.
How long you keep it, or how you decide when to delete it.
What rights people have and how they can exercise them.
How they can complain to the ICO.
If you have a website put a link to your policy in a reasonable font size in a fairly obvious place in the footer of each page so people can find it easily. You should also provide the relevant information when collecting details through enquiry forms, bookings or other channels. You don't need to pay someone to write an elaborate legal document - the ICO provides a free privacy notice generator to help small businesses get started.
4. Keep personal information secure
You have a responsibility to protect the information you hold against unauthorised access, loss, damage and disclosure, which for a small business includes such sensible measures as:
Using strong, unique passwords and two-step verification.
Keeping your computer, phone and software updated.
Restricting access to customer records.
Securing cloud storage and spreadsheets.
Being careful about phishing emails and suspicious links.
Locking away paper records and disposing of them securely.
Keeping appropriate backups of important information.
Think about where customer information actually lives. It might be scattered across your phone, email account, booking system, paper diary and several spreadsheets. If you lose your phone or someone gains access to your email account, how much customer information could they see?
5. Be careful when sharing information
Sometimes you need to share personal information with someone else to run your business. Your accountant may need financial records, for example, or your virtual assistant may need to access customer contact details. Sharing such information isn't automatically a breach of GDPR, but you do need a lawful basis and appropriate safeguards. If a service provider processes personal data on your behalf (a virtual assistant, booking system or email marketing platform, for example), the law requires a written contract with them. With online services this is usually covered by their terms or a data processing agreement, so check it's there. Check how third-party services handle information and don't give them access to more than they need. And if you use AI tools to help with your business, think carefully before entering identifiable customer information. I've covered this in more detail in my separate article on GDPR and AI.
6. Don't keep information for ever
GDPR doesn't set one single time limit for how long you can keep personal information because the amount of time you need to keep business records can vary. This means you need to decide how long information is necessary for each purpose while taking into account the legal requirements of your tax returns and so on. Details contained in an unsuccessful enquiry may be deleted after six months, while HMRC requires sole traders to keep business records for at least five years after the 31 January Self Assessment deadline, so the same kind of data on an invoice may need to be kept for around six years.
Create a simple retention schedule so you know what needs reviewing and when and try and stick to it, so that when information is no longer needed you can delete it promptly and securely. Don't assume you must erase everything as soon as a job is finished, but don't keep information indefinitely just in case it might come in handy.
7. Understand your customers' rights
People have rights over their personal information and depending on the circumstances, they can ask to see the information you hold about them, have inaccurate details corrected, request deletion or object to certain uses. These rights aren't absolute, however. For example, you may need to retain an invoice to meet a legal obligation even if a customer asks you to delete their information. But if someone asks to see their personal data that you hold you must take the request seriously, and bear in mind you don't need to receive a formal legal letter for it to count. Requests generally need to be answered within one month, subject to the applicable rules and exceptions. Since June 2026 you also need a simple way for people to make a data protection complaint to you, such as an email address given in your privacy notice. You must acknowledge a complaint within 30 days and deal with it without undue delay.
8. Take care with marketing and cookies
Using someone's details to fulfil a booking is different from sending them promotional messages. If you want to send marketing emails or texts, you need to consider both data protection law and the Privacy and Electronic Communications Regulations (PECR). The rules depend on who you're contacting and the circumstances - if you're marketing to other sole traders, they're treated as individuals rather than businesses, so consent or a specific exception (such as the 'soft opt-in' for existing customers) will usually be needed. The maximum fines for breaking these rules rose sharply in 2026 to match UK GDPR levels, so it's worth getting right.
Make sure people know what they're signing up for by being honest about what you’re providing and give them an appropriate way to easily unsubscribe. If you have a website, check what cookies and other tracking technologies it uses. Non-essential cookies generally require consent. Since February 2026 there's an exception for analytics cookies used only to produce statistics about your site, but visitors must still be told about them and given an easy way to opt out. A cookie banner isn't enough if it doesn't give visitors a genuine choice, so make sure rejecting cookies is as easy as accepting them.
9. Know what to do if something goes wrong
A data breach could be a stolen phone, a lost paper diary, an email sent to the wrong person or someone gaining unauthorised access to your records. If it happens treat it seriously and act promptly. Contain the problem, establish what information is involved, assess the risks and record what happened. Not every breach needs to be reported to the ICO, but if it is likely to pose a risk to people's rights and freedoms, you generally need to notify the ICO within 72 hours of becoming aware of it. If the risk to people is high, for instance if their financial details have been stolen, you must also tell them without undue delay. It's worth knowing the process before you need it so check out the ICO's personal data breach guidance which explains the requirements.
GDPR makes your business more trustworthy
Data protection can sound like another layer of bureaucracy, but much of it comes down to knowing what information you hold, being clear about how you use it and taking reasonable steps to protect it. You don't need a complicated system to get started – a suitable privacy notice, a clear understanding of why you use personal data, sensible security measures and a plan for dealing with requests or problems will go a long way. Start by reviewing the information you already hold, check whether you need to pay the ICO fee, and work through the points above. You can then deal with any gaps one at a time.
Being open about how you handle your customers’ information is part of running a professional and trustworthy business, so reframe GDPR compliance from needless bureaucracy to being an open and reliable business. It helps people understand what to expect, gives them confidence in dealing with you and helps you keep control of your own business information.
Want a hand with it?
Plenty of sole traders can work through this on their own, and the ICO's guidance is free. But if you'd rather have someone go through it with you, that's something I do. We'll look at what personal information you hold and where it lives, put together a privacy notice that matches how you actually work, and set up a simple retention and breach plan. No jargon and no scare tactics, just the bits that apply to your business. Check out the Services page of the website or drop me an email to find out more.