# Does GDPR apply to small businesses and sole traders?

Start with the personal data you hold, then check your duties, fee and need for a DPO separately.

The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026.

**The short answer.** Yes, a small UK business or sole trader that handles personal data needs to comply with data protection law. Having no staff does not remove that duty. Paying the ICO fee and appointing a data protection officer are separate questions with their own tests ([ICO, Does data protection law apply to my business?](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/does-data-protection-law-apply-to-my-business/shared/results/small/), [ICO, Data protection principles, definitions, and key terms](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-principles-definitions-and-key-terms/), [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/) and [ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).

## What personal data might a sole trader hold?

Names, contact details, email addresses and notes that identify customers can all be personal data. It may be on a phone or computer as well as in the main customer records ([ICO, Data protection when it’s just you: top three tips for sole traders](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-when-it-s-just-you-top-three-tips-for-sole-traders/), checked 7 October 2026).

Data can identify someone on its own or when combined with other information. Holding it counts as processing, even if you do nothing else with it. Processing is the term used for handling personal data ([ICO, Data protection principles, definitions, and key terms](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-principles-definitions-and-key-terms/), checked 7 October 2026).

The ICO recommends making a list of what you hold. Start with the records used to run the business and follow where they are saved or shared ([ICO, Data protection when it’s just you: top three tips for sole traders](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-when-it-s-just-you-top-three-tips-for-sole-traders/), checked 7 October 2026).

## Does a small business need to pay the ICO fee?

Check the fee separately from your wider duties. The ICO has a self-assessment for this. Being exempt from the fee does not mean being exempt from the other data protection rules ([ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).

**Keep these questions separate**

- **Does the law apply?**
  - A small organisation handling personal data must comply.
- **Is a fee due?**
  - Use the ICO fee self-assessment to check.
- **Is a DPO required?**
  - Check the public-body and core-activity tests.

A fee exemption does not answer the other questions.

Source: ICO, Does data protection law apply to my business?, https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/does-data-protection-law-apply-to-my-business/shared/results/small/ (checked 7 October 2026); ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026); ICO, Exemptions, https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/ (checked 7 October 2026)

## What should you put in place first?

Know what you hold, explain what you do with it and keep it safe. The ICO’s sole trader guidance starts with these practical steps ([ICO, Data protection when it’s just you: top three tips for sole traders](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-when-it-s-just-you-top-three-tips-for-sole-traders/), checked 7 October 2026).

You also need a lawful basis, meaning a valid legal reason, for collecting or using personal information. Ask about each purpose rather than assuming one answer covers everything ([ICO, Data protection principles, definitions, and key terms](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-principles-definitions-and-key-terms/), checked 7 October 2026).

**A starting checklist for a small business**

| Start here | What to check |
| --- | --- |
| Know the data | List the personal data you hold and where it is kept. |
| Know the reason | Identify the valid legal reason for collecting or using it. |
| Explain the use | Make a privacy notice available that describes what you do with the data. |
| Protect the records | Use suitable security, including strong device passwords and current antivirus software. |
| Check suppliers | Know who processes data for you; using a supplier does not remove your own responsibility. |

Source: ICO, Data protection principles, definitions, and key terms, https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-principles-definitions-and-key-terms/ (checked 7 October 2026); ICO, Data protection when it’s just you: top three tips for sole traders, https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-when-it-s-just-you-top-three-tips-for-sole-traders/ (checked 7 October 2026)

## Does every small business need a DPO?

No. Under the UK GDPR, a formal DPO is required for public authorities or bodies, except courts acting in their judicial role. It is also required where the main activities involve large scale, regular and systematic monitoring of people ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

The other main activity test concerns large scale use of special category data or data about criminal convictions and offences. Check what the business actually does against these tests; the number of staff is not the test described here ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

If you need help applying the rules, ask for a clear scope of work. Keep general data protection support separate from an appointment to the formal DPO role.

## What to do

1. Make a list of the personal data used in the business ([ICO, Data protection when it’s just you: top three tips for sole traders](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-when-it-s-just-you-top-three-tips-for-sole-traders/), checked 7 October 2026).
2. Check the legal reason for each use ([ICO, Data protection principles, definitions, and key terms](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-principles-definitions-and-key-terms/), checked 7 October 2026).
3. Explain the use in a privacy notice and protect the records ([ICO, Data protection when it’s just you: top three tips for sole traders](https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-when-it-s-just-you-top-three-tips-for-sole-traders/), checked 7 October 2026).
4. Run the ICO fee self-assessment rather than assuming an exemption ([ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).
5. Check the DPO tests against the business’s activities ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

## Common questions

### Does keeping a customer list count as processing?

Yes. Holding information about someone counts as processing, even if you do nothing else with it ([ICO, Data protection principles, definitions, and key terms](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-principles-definitions-and-key-terms/), checked 7 October 2026).

### Can I be exempt from the fee but still have data protection duties?

Yes. The ICO says fee exemption does not remove your other data protection obligations ([ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).

### Does using a supplier remove my responsibility?

No. A controller can use a processor to handle personal data, but keeps responsibility for protecting it. Check what your supplier does and the arrangement between you ([ICO, Data protection principles, definitions, and key terms](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-principles-definitions-and-key-terms/), checked 7 October 2026).

## Where next

- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)
- [Do you have to pay the ICO fee?](https://theassurancedesk.com/guides/ico-data-protection-fee.md)
- [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)
- [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md)
- [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md)

## Sources

- ICO, Does data protection law apply to my business?: https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/does-data-protection-law-apply-to-my-business/shared/results/small/ (checked 7 October 2026)
- ICO, Data protection principles, definitions, and key terms: https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-principles-definitions-and-key-terms/ (checked 7 October 2026)
- ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026)
- ICO, Exemptions: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/ (checked 7 October 2026)
- ICO, Data protection when it’s just you: top three tips for sole traders: https://ico.org.uk/for-organisations/advice-for-small-organisations/news-blogs-and-events/blogs/data-protection-when-it-s-just-you-top-three-tips-for-sole-traders/ (checked 7 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.