Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is the UK GDPR? A plain English guide for small businesses

In one sentence: The UK GDPR is the main UK law on how organisations must look after personal information about customers, staff and anyone else they hold data on.

What it is

Personal data is information that identifies a living person, such as a name, address or telephone number. A data subject is the person it is about. The ICO, the UK regulator, notes the law does not apply after someone has died.

The UK GDPR sits alongside the Data Protection Act 2018. The ICO says some of its guidance is under review because of changes made by the Data (Use and Access) Act, so check the ICO site for the current position.

The ICO’s small-organisation guidance is written for sole traders and small to medium-sized enterprises.

How it works

Article 5 sets out seven key principles, which the ICO calls the heart of the regime:

  1. Lawfulness, fairness and transparency. Use data in a way that complies with the law and that people expect and have been told about.
  2. Purpose limitation. Use data only for the purposes you collected it for.
  3. Data minimisation. Collect only what you need.
  4. Accuracy. Keep it correct and up to date.
  5. Storage limitation. Keep it no longer than necessary.
  6. Integrity and confidentiality (security). Protect it using appropriate technical or organisational measures, including against accidental loss, destruction or damage.
  7. Accountability. Take responsibility and keep records to show how you comply.

Security is where cyber attacks meet the law. A breach caused by weak controls can be an infringement of the security principle.

Who it affects and how badly

Any organisation handling personal data about people in the UK.

  • Sole trader to 10 staff: you still have duties. Worst case: a stolen mailbox leads to a complaint, an investigation and loss of client trust.
  • 10 to 50 staff: accountancy, legal and recruitment firms hold identity and financial details.
  • 50 to 250 staff: schools, charities and care providers hold sensitive data about children and patients.
  • Regulated businesses: the ICO’s higher maximum fine is £17.5 million or, for an undertaking, 4% of total worldwide annual turnover, whichever is higher. The standard maximum is £8.7 million or 2%. These are ceilings, not usual amounts. If you also handle data of people in the EU, the EU GDPR can apply as well.

Real examples

  • Capita, 2025. The ICO fined Capita plc £8m and Capita Pension Solutions Limited £6m, a combined £14m, for failing to ensure the security of personal data after a 2023 attack in which the data of 6.6 million people was stolen. The ICO had first told Capita it intended to fine a combined £45m, then agreed a settlement. The case shows that security failures, not just paperwork failures, can be penalised.

How to detect it

  • Write down what personal data you hold, where it is, who can see it and who you share it with. If you cannot, that is your first gap.
  • Check you can state a lawful basis for each use of the data.
  • Ask whether you could detect a breach and decide quickly whether to report it.
  • Try the ICO’s free Data Protection Essentials self-assessment and training programme, described by the ICO as practical and self-paced.

How to fix or prevent it

  1. Map your personal data: what, where, why and who has access.
  2. Record a lawful basis for each purpose, and publish a clear privacy notice.
  3. Collect less and delete sooner, to meet minimisation and storage limitation.
  4. Protect data with the basics: multi-factor authentication, prompt updates, least-privilege access and staff training.
  5. Keep records that show your decisions. Accountability means being able to demonstrate compliance.
  6. Prepare a breach response plan, including who decides whether to report to the ICO.
  7. Review suppliers who handle your data, and revisit all of this each year.

Related terms

Frequently asked questions

How big can a UK GDPR fine be?
The ICO says the higher maximum is £17.5 million or 4% of worldwide annual turnover, whichever is higher. The standard maximum is £8.7 million or 2%.

Does the UK GDPR apply to small businesses?
Yes. The ICO provides guidance written for sole traders and small to medium-sized enterprises.

Is security part of the UK GDPR?
Yes. The principle of integrity and confidentiality requires appropriate security, and the ICO fined Capita for infringing the security requirements.

Sources

How Wolfcore helps

Wolfcore’s secure-by-design consulting gets you ready for Cyber Essentials Plus, ISO 27001, SOC 2 or NIS2 without the paperwork taking over.