A plumbing firm with eleven regular commercial customers and a couple of hundred domestic ones has a laptop taken from a van outside a house in Bristol. It has the customer database on it, the estimating spreadsheets, and a folder of scanned identity documents from when they last hired.
The owner's first instinct is that it is an insurance matter. It is partly an insurance matter. It is also, potentially, a personal data breach with a seventy-two hour clock on it, and the thing that decides which is whether the laptop was encrypted.
Six lawful bases, and most of yours are two of them
The UK GDPR, sitting alongside the Data Protection Act 2018, requires that every use of personal data has a lawful basis. There are six, and small firms overwhelmingly rely on two or three.
Contract covers everything you need to do to deliver what a customer asked for, or to take steps at their request before entering a contract. Sending an invoice, arranging an appointment, ordering a part in someone's name. You do not need consent for any of that and asking for it confuses everybody.
Legal obligation covers things the law makes you do: keeping payroll records for HMRC, right to work check evidence, health and safety records.
Legitimate interests covers most of the rest, including ordinary business administration, fraud prevention, network security and much direct marketing to existing customers. It requires you to have identified the interest, considered whether the processing is necessary for it, and balanced it against the individual's rights. That balancing exercise is meant to be written down, briefly, before you rely on it. Two paragraphs is enough.
Consent is the one people reach for and the one that is usually wrong. Consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action, and capable of being withdrawn as easily as it was given. If withdrawing it would mean you cannot do the job, it was never freely given and the correct basis was contract.
Special category data, which includes health, ethnicity, religious belief, trade union membership, sexual orientation and biometric data, needs an additional condition under Article 9 as well as a lawful basis. Employers hold more of it than they think, mostly in sickness records.
Marketing has its own rulebook on top. The Privacy and Electronic Communications Regulations govern electronic marketing and require consent for most unsolicited emails and texts to individuals, subject to a narrow soft opt-in for your own existing customers on similar products.
The ICO fee is small and the penalty for not paying it is not
Most organisations that process personal data must pay a data protection fee to the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018. It is a fee, not a registration in the old sense, and the amount is tiered by size and turnover, with the lowest tier costing a few tens of pounds a year and the highest a few thousand. The amounts are set by regulation and have been revised, so check the current tier table.
There are exemptions for organisations processing only for limited purposes such as staff administration and their own accounts, but using CCTV for crime prevention removes the exemption, so a business with a camera over its yard almost always pays. The fee is not the risk. A firm which has not noticed the fee has usually not noticed anything else either.
Beyond the fee, the practical obligations are modest. You need a privacy notice telling people what you collect, why, on what basis, who you share it with and how long you keep it, usually a page on your website referenced from your forms. You need a record of your processing activities, since the exemption for organisations under 250 employees does not cover regular processing or special category data. Most small firms will not need a data protection officer.
The Data (Use and Access) Act 2025 made a number of changes to this framework, including to complaints handling and to the treatment of certain recognised legitimate interests. If your policies were written before it, they are due a read through.
A subject access request costs you time, not money
Any individual can ask what personal data you hold about them, and you must respond within one month. It is free. You can extend by up to two further months where the request is complex or where there are numerous requests, provided you tell the person within the first month why.
You can refuse only where a request is manifestly unfounded or excessive, and the bar for that is high.
The cost is search time. A request from a departing employee, which is the most common kind, means going through emails, HR files, appraisal notes, WhatsApp messages on work matters, and CCTV. The message that matters is not the formal file, it is the message where a manager described them in terms they would rather not have written down. There is no exemption for embarrassment.
You must redact third party personal data where it is not reasonable to disclose it without that person's consent, which is fiddly manual work. Other exemptions apply, including for material subject to legal professional privilege and for confidential references you gave.
Two habits make this survivable. Write as though everything will be read by the person it is about. And know where your data actually is, including the personal phone with customer numbers on it and the old laptop in a cupboard.
Retention is the related discipline. Data must not be kept longer than necessary, but necessary is defined by other things. Payroll records have their own retention periods, National Minimum Wage records run to six years, right to work evidence for two years after employment ends, and accounting records for six years. Write down a schedule, apply it, and delete the rest. Most small firms have never deleted anything, which turns every subject access request into an archaeology project and every breach into a bigger one.
Seventy-two hours starts when you become aware
A personal data breach is any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Losing it counts. So does sending it to the wrong person, and so does a ransomware attack that encrypts it away from you.
If a breach is likely to result in a risk to the rights and freedoms of individuals, you must report it to the ICO without undue delay and where feasible within seventy-two hours of becoming aware of it. If you report late, you explain why. If the risk to individuals is high, you must also tell the individuals themselves, promptly and in plain language.
Not every breach is reportable, and you must record every one anyway, including the ones you decide not to report and your reasoning. That internal log is what the ICO asks for.
The plumber's laptop shows why encryption matters commercially rather than technically. Full disk encryption with a strong password means the data is not accessible, which usually means the risk is low, which usually means no report and no notification to customers. Device encryption is free on every current operating system. Turning it on is a fifteen minute job that changes a bad week into an insurance claim.
The rest of the practical work is similarly unglamorous. Multi-factor authentication on email, because business email compromise is the most common serious incident. Access limited to staff who need it. Backups that are tested and held separately. A short written procedure saying who to ring and what to do in the first hour. Cyber Essentials certification is a reasonable target for a small firm and increasingly a condition of public sector contracts.
Where this shows up in the game
Business Baron treats customer and staff data as an asset with a liability attached. Hold more than you need, keep it badly, and a break-in or a lost device becomes a regulatory matter as well as a replacement cost, with a clock running from the day you found out. The ICO is one of the bodies that can turn up, and how you handled a breach feeds the trust your customers have in you, which recovers slowly. That includes the letter you did not want.