Is GDPR compliance mandatory for all businesses in the UK?

Yes. If your UK business or charity handles personal data, UK data protection law applies to you, whatever your size. The rules are set out in the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and are regulated by the Information Commissioner’s Office (ICO).

What counts as personal data?

Any information that identifies a living person, including customer and staff names, email addresses, phone numbers, CCTV footage, IP addresses and HR records. Almost every organisation holds some.

Key obligations for small businesses

• Pay the ICO data protection fee unless you’re exempt. Most small organisations pay £52 or £78 a year. Use the ICO’s online self-assessment to check.
• Have a lawful basis for each type of data you use, such as a contract, legal obligation or consent.
• Publish a privacy notice explaining what you collect and why.
• Keep data secure with measures such as multi-factor authentication, encryption, backups and up-to-date devices.
• Respond to requests from individuals, such as subject access requests, usually within one month.
• Report serious breaches to the ICO within 72 hours of becoming aware of them.

Do small businesses get fined?

The ICO usually starts with advice and reprimands for small organisations, but it can fine up to £17.5 million or 4% of global turnover for the most serious breaches.

How ABCOM helps

We can’t give legal advice, but we can put the technical security in place that data protection law expects, and Cyber Essentials is a good way to show it. See our cyber security services.