What GDPR Policies Does a Small Business Need?

If your business collects or uses personal information - whether that's customer details, employee records, enquiries, CCTV or marketing data - UK GDPR applies to you.

But knowing you need to comply is the easy bit. Knowing which GDPR policies, procedures and records your particular business actually needs is where it gets more complicated.

This guide explains the key GDPR documents small businesses should consider, what they're for, and when you actually need them.
 

There isn't one set of GDPR policies every business needs

GDPR isn't about downloading a standard set of documents and putting them in a folder. The policies and procedures your business needs depend on what personal information you collect, why you use it, who you share it with and how your business operates.

That said, there are some core documents that most small businesses should have in place - and a few others that become necessary depending on what you do.

The core GDPR policies for a small business

While the exact documents your business needs will depend on how you use personal data, there are some core policies that provide a strong foundation for GDPR compliance.

Data Protection Policy
Sets out your overall approach to data protection - how personal data should be handled, the principles your business follows and the responsibilities of people working within the organisation.

Data Retention and Disposal Policy
Explains how your business decides how long personal data should be kept and how information should be securely deleted or disposed of when it is no longer needed.

Personal Data Security Policy
Sets out the practical and organisational measures your business uses to keep personal data secure, including how information should be accessed, stored, shared and protected.

Data Rights Policy and Procedure
Explains how your business will recognise and deal with individuals exercising their data protection rights - including subject access, rectification, erasure, restriction and objection.

Personal Data Breach Policy and Procedure
Sets out what should happen if personal data is lost, disclosed to the wrong person, accessed without permission or otherwise compromised - including how the incident is assessed, recorded and, where required, reported.

Policies are only part of GDPR compliance

Having the right policies is important - but they need to work in practice too.

Small businesses also need simple ways to record decisions, deal with incidents, check suppliers and make sure data protection is considered when something changes.

That's why the Novo GDPR Ready Pack also includes practical tools to help you put your policies into practice:

Retention Schedule Template (with examples)
A practical starting point for deciding how long different types of personal data should be kept, with examples to help you build a retention schedule that works for your business.

Personal Data Breach Reporting Form
A simple way for staff to record and report a suspected personal data breach so it can be assessed quickly.

Personal Data Breach Register
A central record for documenting breaches, what happened, the action taken and the outcome.

Privacy by Design & New Processing Checklist
A practical check to use when introducing a new system, supplier, process or way of using personal data - helping you spot data protection issues before they become problems.

Supplier/Processor Data Protection Due Diligence Checklist
Helps you ask the right questions before entrusting personal data to another organisation and document the checks you've carried out.

The aim isn't to give you more paperwork. It's to give you a framework you can actually use.

Depending on your business, you may also need...

Not every business processes personal data in the same way. Depending on what you do, you may need additional documentation or assessments alongside your core GDPR policies.

Privacy Notice / Privacy Policy
This explains to customers, employees or other individuals how you use their personal information. It needs to reflect what your business actually does - which is why a meaningful privacy notice can't simply be dropped into a standard policy pack.

Record of Processing Activities (RoPA)
A RoPA provides a detailed record of your personal data processing activities. Whether you are legally required to maintain one will depend on your processing, but it can also be a useful way of understanding and documenting how personal data moves through your business.

Legitimate Interests Assessments (LIAs)
If you rely on legitimate interests for particular processing, you may need to document the interest you're pursuing, why the processing is necessary and how you've balanced it against individuals' rights.

CCTV and employee monitoring documentation
Businesses using CCTV, vehicle tracking or other forms of employee monitoring may need additional assessments, policies and transparency information.

International data transfer documentation
Using suppliers or systems that transfer personal data outside the UK can mean additional safeguards and assessments are required.

Some requirements need a more detailed assessment of your individual processing and sit outside the standard GDPR Ready Pack. Novo can prepare these separately where they're needed.

Do I need a Privacy Policy?

A privacy policy - often called a privacy notice - is different from your internal Data Protection Policy.

Your Data Protection Policy explains how your business manages data protection internally. Your privacy notice tells customers, employees and other individuals what you do with their personal information.

It should explain things such as what information you collect, why you use it, your lawful basis, who you share it with, how long you keep it and the rights people have.

Because every business uses personal data differently, a meaningful privacy notice needs to reflect your actual processing. That's why it isn't included as a generic document in the GDPR Ready Pack.

Novo can prepare a tailored Privacy Policy separately, either alongside your GDPR Ready Pack or as a standalone service.