Data Protection Basics for Businesses Handling Personal Data

Almost every business handles personal data. Customer names and addresses, employee records, supplier contacts, CCTV footage, website enquiry forms and even email signatures all count. Data protection laws such as the UK GDPR and the EU GDPR, and many similar frameworks around the world, set out how such information must be treated. The detail varies between jurisdictions, but the underlying principles are broadly consistent. This guide explains those principles in practical terms and suggests steps a business can take to meet them. It is general guidance, not legal advice; for specific situations, consult your regulator's published guidance or a qualified adviser.

What counts as personal data

Personal data is any information relating to an identified or identifiable living individual. That includes obvious items such as names, email addresses and phone numbers, but also identifiers such as IP addresses, device IDs, account numbers and photographs. Information about a person in a business role, such as a named contact at a supplier, is generally still personal data.

Some categories are treated as more sensitive and attract stricter conditions. Under GDPR-style frameworks these include health information, racial or ethnic origin, religious beliefs, trade union membership, biometric and genetic data, and information about sex life or sexual orientation. Criminal convictions data is also subject to additional controls.

It also matters whether your business is a controller, deciding why and how data is processed, or a processor, acting on behalf of a controller. An IT services firm managing a client's systems will often be a processor for that client's data, while being a controller for its own staff and customer records.

The core principles

GDPR-style laws are built around a small set of principles. Understanding these helps with almost every practical question.

1. Lawfulness, fairness and transparency – you need a valid lawful basis for processing, must not use data in ways people would not reasonably expect, and must tell them clearly what you do with it.
2. Purpose limitation – collect data for specified, explicit purposes and do not reuse it for unrelated purposes without proper consideration.
3. Data minimisation – collect only what you actually need for the purpose.
4. Accuracy – keep data accurate and up to date, and correct errors promptly.
5. Storage limitation – do not keep personal data longer than necessary.
6. Integrity and confidentiality – protect data with appropriate security measures.
7. Accountability – be able to demonstrate how you comply, not merely assert that you do.

Choosing a lawful basis

GDPR-style frameworks list several lawful bases for processing. The most commonly used by businesses are:

• Contract – processing necessary to deliver a contract with the individual, such as using a customer's address to deliver goods.
• Legal obligation – processing required by law, such as keeping payroll records for tax purposes.
• Legitimate interests – processing that is necessary for your legitimate interests, provided those interests are not overridden by the individual's rights. This requires a balancing assessment that you should document.
• Consent – freely given, specific, informed and unambiguous agreement, which can be withdrawn as easily as it was given.

A common misconception is that consent is always required. In practice, consent is often not the most appropriate basis, especially in employment, where the power imbalance means consent may not be considered freely given. Choose the basis that genuinely fits the purpose and record your reasoning. Direct marketing by electronic means is often also governed by separate rules on electronic communications, so check those as well.

Practical steps to get organised

Map your data

Create a record of processing activities: what personal data you hold, where it came from, why you hold it, which lawful basis applies, where it is stored, who can access it, who it is shared with and how long it is kept. A spreadsheet is a perfectly reasonable starting point for a small business. This record underpins almost everything else.

Update privacy information

Your privacy notice should explain, in clear language, what you collect, why, the lawful basis, who you share it with, retention periods, international transfers and how people can exercise their rights. Make sure it reflects what you actually do, not a generic template.

Review suppliers

Any supplier processing personal data on your behalf, such as a payroll provider, cloud email service, CRM or IT support firm, should be bound by a written agreement setting out their obligations. Check where they store data and whether international transfer safeguards are in place.

Set retention periods

Decide how long each category of data is kept and why, then put processes in place to delete or anonymise it when that period ends. Some periods are driven by legal requirements; others are business judgements you should be able to justify.

Security measures that matter

The law requires security appropriate to the risk. For most businesses, the following measures form a sensible baseline:

• Multi-factor authentication on email, cloud services and remote access.
• Role-based access, so staff only see the personal data their job requires.
• Encryption of laptops, mobile devices and backups.
• Timely patching of operating systems and applications.
• Reliable, tested backups.
• Staff training on phishing, handling requests and recognising a breach.
• Secure disposal of devices and paper records.
• Logging and monitoring sufficient to detect and investigate incidents.

Individual rights and breaches

People have rights over their data, including the right to access it, have it corrected, have it erased in certain circumstances, restrict or object to processing, and in some cases receive it in a portable format. Requests can arrive by any channel, not only through a formal form, so staff need to recognise them and know where to pass them. Statutory deadlines apply, so log each request with the date received.

A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. That includes an email sent to the wrong recipient, a lost unencrypted laptop or a ransomware attack. Under GDPR-style rules, certain breaches must be reported to the regulator within a short, fixed timeframe, and in some cases affected individuals must be told. Prepare a simple breach response procedure in advance: who to inform internally, how to contain the incident, how to assess risk and how decisions are documented, including decisions not to report.

Data protection starter checklist

• Record of processing activities created and kept current
• Lawful basis identified and documented for each purpose
• Privacy notice accurate and easy to find
• Agreements in place with all processors
• Retention schedule agreed and applied
• Baseline security controls implemented
• Process for handling individual rights requests
• Breach response procedure written and understood
• Staff trained, with refreshers scheduled

Conclusion

Data protection compliance can seem daunting, but its principles are largely common sense: know what you hold, have a good reason for holding it, keep only what you need, look after it properly and be open with people about how you use it. Start with a data map, because it reveals where the real risks and gaps are. Then work through privacy information, supplier agreements, retention and security. Keep records of your decisions so you can demonstrate accountability. Where questions become complex, particularly around sensitive data, international transfers or new technologies, refer to your regulator's guidance or seek professional advice.