GDPR compliance is a legal requirement for any UK small business that handles personal data of individuals in the UK or EEA. Meeting these obligations protects customer trust and helps avoid regulatory action from the Information Commissioner’s Office.
This checklist focuses on the core areas every early-stage founder and online seller must address: choosing a lawful basis, managing consent, conducting data audits, preparing breach procedures, and maintaining proper documentation. Follow the steps below to build a practical and proportionate approach suitable for a startup.
Understanding Lawful Basis for Processing Personal Data
Every time your business processes personal data you must have a valid lawful basis. The six bases are consent, contract, legal obligation, vital interests, public task, and legitimate interests. For most UK e-commerce startups the most relevant are contract, legitimate interests and consent.
Decide on your basis before you start collecting data. For example, processing a customer’s name and address to fulfil an order relies on the contract basis because it is necessary to deliver the goods you agreed to supply. Using legitimate interests for marketing requires a balancing test: document why your interest outweighs the individual’s rights and offer an easy opt-out. Review your basis whenever you change how you use the data. Record your decision and the reasoning in a simple internal log so you can demonstrate compliance if asked.
Obtaining and Managing Consent
Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes or implied consent do not meet the standard. For an online store this means clear statements next to each checkbox explaining exactly what the person is agreeing to, such as “I agree to receive email updates about new products and offers (you can unsubscribe at any time).”
Make withdrawal of consent as easy as giving it. Provide an unsubscribe link in every marketing email and keep a record of when consent was given, what it covered, and when it was withdrawn. Revisit consent if you introduce a new purpose or channel. For startups with limited resources, focus consent requests only on activities that truly require it rather than asking for blanket permissions that weaken your position.
Conducting a Data Audit
A data audit maps exactly what personal information you hold, where it comes from, why you need it, how long you keep it and who you share it with. Start by listing every place data is stored: website forms, order management system, email marketing tool, accounting software, spreadsheets and paper records.
For each data item ask: what is the lawful basis, is the data minimised to only what is necessary, how long will we keep it, and do we have a deletion process? An e-commerce seller might discover they are holding customer phone numbers never used for order fulfilment; this data should be removed or the basis justified. Update the audit at least once a year or after any significant change such as adopting a new payment provider or launching a loyalty programme. The resulting record of processing activities forms a key piece of documentation required under GDPR.
Preparing Data Breach Procedures
A personal data breach is any incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Create a simple written procedure now so you can respond quickly if an incident occurs.
The procedure should include: who is notified inside the business, how to contain the breach, what details to record (what happened, when, how many people affected, type of data), and when to report to the ICO. Not every breach must be reported, but those likely to result in risk to people’s rights and freedoms must be notified within 72 hours. Customers must be told if the risk is high. Test the procedure with a walkthrough scenario such as a lost laptop or hacked email account. Keep records of all breaches, even those not reported, as the ICO may ask to see them.
Documentation and Accountability
Accountability is a core GDPR principle. You must be able to show how you comply, not just claim that you do. Maintain a central folder containing: your data audit or record of processing activities, privacy policy, legitimate interest assessments, consent records, data processor contracts, breach log, and staff training notes if you have employees.
Write a short privacy notice that explains in plain English what data you collect, why, how long you keep it, and what rights individuals have. Publish it on your website and link to it at the point of data collection. Review all documents when processes change. For a small team this need not be complex; a few clear Word or Google documents updated regularly are sufficient. The ICO website provides templates that can be adapted to your specific activities.
Practical Next Steps for UK Startups
Begin with the data audit because it informs every other decision. Assign one founder or team member to own GDPR compliance and schedule a review every six months. Integrate checks into routine tasks: when you add a new app, ask what data it will access and whether the provider is based in the UK or offers adequate safeguards. Train yourself and any future staff on the basics so that handling subject access requests or deletion requests becomes routine.
Remember that requirements can evolve. Always check the latest guidance on the ICO website rather than relying on general advice. Early attention to these areas reduces the chance of costly mistakes later when your customer base grows. Many founders at Loomworks have found that building these habits from day one makes scaling smoother and demonstrates seriousness to potential partners and investors.
Frequently asked questions
Do I need to appoint a Data Protection Officer for my small business?
Most UK startups and small e-commerce businesses do not need a formal Data Protection Officer. You only need one if your core activities involve large-scale regular monitoring of individuals or large-scale processing of special category data. Instead, designate someone internally to oversee data protection matters and ensure you follow ICO guidance.
What should my privacy policy include for an online store?
Your privacy policy should explain what personal data you collect, the lawful basis for processing it, how long you keep it, who you share it with, and the rights customers have including access, rectification, erasure and objection. Keep the language clear and update it whenever your practices change.
How long can I keep customer data after an order?
You should keep data only as long as necessary for the purpose. This might mean six years for accounting records required by HMRC, but marketing consent should be refreshed or removed much sooner if the person has not engaged. Document your retention periods in your data audit and delete or anonymise data when it is no longer needed.
What happens if I suffer a data breach?
Follow your documented procedure: contain the breach, assess the risk to individuals, record the facts, and report to the ICO within 72 hours if there is a risk to rights and freedoms. Inform affected customers if the breach is likely to cause them significant harm. Even minor incidents should be logged internally.
Can I use legitimate interests instead of consent for email marketing?
You can rely on legitimate interests for some types of marketing but you must complete a legitimate interests assessment showing that your interest is not overridden by the individual’s rights. It is usually safer and simpler to use consent for electronic direct marketing to avoid complaints and ensure compliance with the Privacy and Electronic Communications Regulations.
Related reading: Running pricing experiments in your UK ecommerce store, Protecting your mental health as a UK startup founder, Is B Corp certification right for your UK startup?. Browse all starting a business guides or apply to Loomworks.