GDPR Help & Advice
Data protection doesn't need to be complicated.
Whether you're wondering if your business needs GDPR policies, what to do about CCTV or how to handle personal information, we've put together straightforward answers to common questions.
No unnecessary jargon. Just practical guidance to help you understand your responsibilities.
If your business collects or uses personal data, you have responsibilities under UK data protection law, regardless of how big or small your business is.
Written policies help explain how you collect, use, protect, share and retain personal information, and what to do if something goes wrong.
Not every business needs the same policies, but your arrangements should reflect how your business operates and the personal data you handle.
Yes. If your business collects or uses personal data, you will generally need to explain how and why that information is used, your lawful basis, who it may be shared with and how long it is kept.
You don't need a website to do this. Privacy information can be provided on paper, by email, in person or through other suitable methods.
Many UK businesses, including sole traders and small companies, need to register with the Information Commissioner's Office and pay an annual data protection fee.
Some businesses qualify for exemptions, depending on how they use personal information. If you operate CCTV for crime prevention, you will generally need to register.
Registration fees currently start at £52 per year.
Yes. Businesses can use CCTV for security, crime prevention and other legitimate purposes, but there are data protection rules to follow.
You'll generally need clear signage, a lawful basis for recording, appropriate privacy information and documented procedures for managing footage. You may also need to register with the ICO.
Recording sound or monitoring employees requires particular care.