Does GDPR apply to small businesses and sole traders?

What personal data might a sole trader hold?

Names, contact details, email addresses and notes that identify customers can all be personal data. It may be on a phone or computer as well as in the main customer records.

Data can identify someone on its own or when combined with other information. Holding it counts as processing, even if you do nothing else with it. Processing is the term used for handling personal data.

The ICO recommends making a list of what you hold. Start with the records used to run the business and follow where they are saved or shared.

Does a small business need to pay the ICO fee?

Check the fee separately from your wider duties. The ICO has a self-assessment for this. Being exempt from the fee does not mean being exempt from the other data protection rules.

What should you put in place first?

Know what you hold, explain what you do with it and keep it safe. The ICO’s sole trader guidance starts with these practical steps.

You also need a lawful basis, meaning a valid legal reason, for collecting or using personal information. Ask about each purpose rather than assuming one answer covers everything.

Does every small business need a DPO?

No. Under the UK GDPR, a formal DPO is required for public authorities or bodies, except courts acting in their judicial role. It is also required where the main activities involve large scale, regular and systematic monitoring of people.

The other main activity test concerns large scale use of special category data or data about criminal convictions and offences. Check what the business actually does against these tests; the number of staff is not the test described here.

If you need help applying the rules, ask for a clear scope of work. Keep general data protection support separate from an appointment to the formal DPO role.

What to do

1. Make a list of the personal data used in the business.
2. Check the legal reason for each use.
3. Explain the use in a privacy notice and protect the records.
4. Run the ICO fee self-assessment rather than assuming an exemption.
5. Check the DPO tests against the business’s activities.

Common questions

Does keeping a customer list count as processing?

Yes. Holding information about someone counts as processing, even if you do nothing else with it.

Can I be exempt from the fee but still have data protection duties?

Yes. The ICO says fee exemption does not remove your other data protection obligations.

Does using a supplier remove my responsibility?

No. A controller can use a processor to handle personal data, but keeps responsibility for protecting it. Check what your supplier does and the arrangement between you.

Where next

• Who is a data controller, and who is a processor?
• Do you have to pay the ICO fee?
• Do you need a data protection officer? UK GDPR sets three tests
• How do I choose a data protection or AI governance adviser?
• Article 28: what must a processor contract say?
• UK GDPR’s seven principles, in plain English

This is an independent editorial guide, not legal advice.