💭 Ask yourself...

"Why do I need this information?"

If you can't answer that question clearly...

Don't collect it.

Short answer

Registering with the ICO (where required) doesn't give you permission to collect whatever information you like.

Every piece of personal information you collect should have a clear reason.

Before asking someone for their information, ask yourself:

Why do I need this?

If you can't explain the purpose, there's a good chance you shouldn't be collecting it.

Why is this important?

Many businesses think data protection starts with privacy notices and paperwork.

It doesn't.

It starts much earlier.

It starts the moment you decide to ask somebody for their information.

Good data protection isn't about collecting as much information as possible.

It's about collecting only what you genuinely need, using it only for the reason you collected it, and keeping it only for as long as necessary.

Real-life example

Imagine you own a plumbing business.

A customer contacts you because they have a leaking pipe.

You ask for:

✔ Their name.

✔ Their address.

✔ Their telephone number.

That all makes sense.

You need that information to carry out the work.

Now imagine you also ask:

❌ Date of birth.

❌ Marital status.

❌ National Insurance number.

Could you explain why?

Probably not.

If the information isn't needed, don't collect it.

It doesn't stop there...

Let's say you've repaired the customer's boiler.

A few months later you decide to start selling home insurance.

Can you use the customer's details for that?

Maybe.

Maybe not.

That depends on why you originally collected their information, what you told them you would use it for, and which lawful basis applies.

Collecting information for one purpose doesn't automatically mean you can use it for another.

Can you do this yourself?

✅ Probably yes if...

Before collecting information you can answer:

• Why do I need it? 
• What will I use it for? 
• Does the customer expect me to use it in that way? 
• Am I collecting more than I need? 
• How long will I keep it? 

⚠️ It may be worth getting some support if...

• You're collecting special category information. 
• You want to start marketing to existing customers. 
• You want to share information with another organisation. 
• You're introducing AI or new technology. 
• You're unsure whether your original purpose still applies. 

❌ "I've already collected the information, so I can do what I like with it."

Not quite.

Collecting personal information doesn't give you unlimited permission to use it. You should only use it for the purpose you originally collected it for, unless you have a lawful reason to process it for a new purpose and have considered whether you need to tell the individual.

❌ "I can share personal information with another company whenever I want."

Not necessarily.

Before sharing personal information, ask yourself:

• Why am I sharing it? 
• Do I have a lawful basis? 
• Would the individual reasonably expect me to share it? 
• Have I explained this in my privacy information? 

Sharing information without a clear purpose or lawful basis can breach UK GDPR.

❌ "If I think the information might be useful one day, I should keep it."

Usually not.

Personal information should only be kept for as long as it's needed for the purpose it was collected. Keeping information "just in case" increases your risk and doesn't usually reflect good data protection practice.

❌ "The more information I collect, the better."

Not necessarily.

Good data protection isn't about collecting everything you can. It's about collecting only what you genuinely need to achieve your purpose.

Asking for unnecessary information can increase your compliance obligations and your risk if something goes wrong.

❌ "I've told the customer once, so I never need to update my privacy information."

Not always.

If the way you use personal information changes, you should consider whether your privacy information remains accurate. Transparency isn't a one-off exercise—it's an ongoing commitment to keeping people informed.

❌ "If someone gives me their business card, I can use their details however I like."

Not necessarily.

Receiving someone's contact details doesn't automatically mean you can use them for any purpose. Think about why they shared their information with you and what they would reasonably expect to happen next.

Practical steps

Before collecting any personal information...

Ask yourself:

1. Why do I need this? 
2. Do I really need every piece of information I'm asking for? 
3. How will I use it? 
4. How long will I keep it? 
5. Have I explained this to the individual? 

If you can answer those five questions confidently, you're already building strong data protection practices.

🤝 Need a little support?

Most businesses don't intentionally collect too much information. It usually happens because nobody has ever stopped to ask "Why do we need this?"

If you're reviewing your forms, introducing a new process or simply want someone to sense-check what you're collecting, we're here to help.

Sometimes asking one simple question at the start can prevent much bigger problems later.

 Related Guides:

Do I Need to Register with the ICO? 

Reasons for Collecting Personal Data 

What to do with a Subject Access Request