Data protection and UK GDPR compliance for startups

Start with a data map: what personal data you hold, where it came from, why you have it, where it is stored, who has access, which third parties receive it and how long you keep it. Include employee and candidate data, not just customer data — HR processing is where smaller organisations most often fall short.

The map drives everything else. Your privacy notice, your record of processing activities, your retention schedule and your answers to customer questionnaires all come from it. Building the policies first, then trying to make reality match them, is the slower route.

Every processing activity needs a lawful basis: consent, contract, legal obligation, vital interests, public task or legitimate interests. For B2B SaaS, contract and legitimate interests do most of the work; consent is mainly relevant to marketing and cookies.

Where you rely on legitimate interests, carry out and document a legitimate interests assessment weighing your purpose against the individual's rights. If you process special category data — health, biometrics, ethnicity, trade union membership and others — you also need a separate Article 9 condition and usually an appropriate policy document.

The core set is: an external privacy notice for customers and website visitors, an internal employee privacy notice, a record of processing activities, a data retention schedule, an information security policy, a data breach response procedure and a data subject request procedure.

Add a cookie policy and a compliant consent banner if your site uses non-essential cookies — the Privacy and Electronic Communications Regulations require consent for those, and 'implied consent' banners are not compliant. A data protection impact assessment is required for high-risk processing such as large-scale profiling or systematic monitoring.

Every supplier that processes personal data on your behalf — hosting, analytics, email, CRM, payroll, support tooling — needs a written contract meeting Article 28. Most large providers offer a standard data processing addendum; collect and file them rather than assuming they apply automatically.

For transfers outside the UK, identify the mechanism: adequacy regulations, the International Data Transfer Agreement, or the UK addendum to the EU standard contractual clauses, supported by a transfer risk assessment. Keep a current list of sub-processors, because customer contracts increasingly require notice of changes.

Article 32 requires appropriate technical and organisational measures. In practice that means access controls, multi-factor authentication, encryption in transit and at rest, logging, backups, patching, supplier due diligence and staff training — proportionate to the risk.

A personal data breach must be reported to the Information Commissioner's Office without undue delay and within 72 hours where it is likely to result in a risk to individuals, and affected individuals must be told where the risk is high. Write and rehearse the procedure in advance: the 72 hours starts when you become aware, not when you finish investigating.

Direct marketing is governed by PECR as well as the UK GDPR. Business-to-business email marketing to corporate subscribers is more permissive than B2C, but you still need a clear opt-out in every message and accurate sender identification. Marketing to individuals and sole traders generally requires consent or the narrow soft opt-in.

Most organisations that process personal data must pay the ICO's data protection fee and register. It is inexpensive, quickly done, and the register is public — which means customers and investors can check whether you have done it.