Does my small business need GDPR policies?

You don't need hundreds of customers, a large workforce or an IT department for data protection law to apply to your business.

If you collect customer names, hold employee information, keep email addresses, use CCTV or store supplier contact details, you're probably processing personal data.

And that means you need to think about how you collect it, why you need it, how you protect it and when you should delete it.

But I'm only a small business!

It doesn't matter whether you have two employees or two hundred. The UK GDPR and Data Protection Act 2018 don't provide a general exemption just because a business is small.

What changes is what's appropriate for your business.

A small independent café won't necessarily need the same level of documentation as a hospital or financial services company.

However, both need to understand their responsibilities and be able to demonstrate how they protect personal data.

Do I legally need written GDPR policies?

The UK GDPR requires organisations to take appropriate measures to protect personal data and demonstrate compliance.

Documented policies and procedures are an important way of doing this, particularly where staff handle personal information or a business processes sensitive data.

Not every organisation is legally required to have an identical set of written policies. The level of documentation should reflect the nature, scale and risks of its activities.

For most businesses, having clear, proportionate policies is a sensible starting point.

They help establish consistent rules rather than leaving everyone to make their own decisions about personal information.

What should my GDPR policies cover?

Depending on your activities, your business may need documented arrangements covering:

Data protection: How personal data is collected, used and managed, and who is responsible.

Retention and disposal: How long information is kept and how it is securely deleted.

Information security: How personal data is protected against loss, theft or unauthorised access.

Individual rights: What happens when somebody asks to see, correct or delete their personal information.

Personal data breaches: How incidents are reported, assessed, recorded and, where required, notified.

Suppliers: How you check that businesses handling personal data on your behalf have appropriate safeguards.

Privacy by design: How you consider data protection when introducing new systems, suppliers or ways of working.

Some businesses will need additional documentation, particularly where they process children's information, sensitive personal data or undertake higher-risk activities.

Isn't having a privacy policy on my website enough?

No.

A privacy notice explains to individuals how their personal data is used.

An internal Data Protection Policy is different. It establishes how your organisation manages personal data and the responsibilities of the people handling it.

You may need both, but they serve different purposes.

Can I just download free GDPR templates?

You can use templates as a starting point, but they need to reflect what your business actually does.

For example, a policy shouldn't claim that your business encrypts all customer data, conducts regular security audits or uses particular security controls unless that's true.

Similarly, your retention arrangements need to reflect the information you actually hold and the reasons for keeping it.

A policy that looks impressive but doesn't reflect your working practices isn't particularly useful.

What happens if I don't have GDPR policies?

Not having a particular policy doesn't automatically mean you've broken the law.

However, if you can't explain or demonstrate how you manage personal information, it may be difficult to show that you're meeting your data protection obligations.

Clear policies can also help prevent avoidable mistakes, particularly when staff are unsure how to handle personal information, respond to a request or report a potential breach.

Where should I start?

Start by understanding what personal data your business holds, why you need it, who has access to it and how long it should be kept.

Then make sure you have appropriate policies and procedures that reflect those activities.

They don't need to be unnecessarily complicated. They do need to be accurate, proportionate and put into practice.

How Novo can help

At Novo Data Services, we believe data protection should be straightforward, particularly for smaller businesses without their own compliance department.

Our GDPR Ready Pack (£495 + VAT) provides ten tailored policies and practical documents, prepared using information about your business.

It's not simply a collection of blank policy templates. It's designed to give you a practical starting point for putting appropriate data protection arrangements in place.

Explore the Novo GDPR Ready Pack

Making data protection feel simple.