No links in this guide are paid. We are not affiliated with HMRC, Companies House, the ICO, the British Business Bank or Start Up Loans; we link to their free guidance because it is reliable.
Not financial advice: this guide is general information to help you understand the basics. It is not financial, tax or legal advice. Rules and figures can change, so check the linked official pages, and speak to an accountant or adviser about your situation.
Almost every business handles personal data: customer names, phone numbers, emails, addresses or staff records. And many activities need a licence or permit. This guide covers the basics and links to the official guidance from the ICO and GOV.UK.
Data protection basics
If you use personal information in your business, you must follow data protection law (UK GDPR and the Data Protection Act 2018). In practice that means: only collect what you need, tell people what you do with it, keep it secure and accurate, don't keep it longer than you need, and respect people's rights, such as asking to see or delete their data. Source: GOV.UK: Data protection in your business.
The ICO has a hub of practical advice for small businesses, including templates and checklists: ICO: Advice for small organisations.
Do you need to pay the data protection fee?
Most organisations that process personal information must pay an annual data protection fee to the Information Commissioner's Office (ICO), unless they are exempt. Use the ICO's self-assessment to check: ICO: Data protection fee self-assessment. The fees (checked 29 October 2026) are:
| Tier | Who | Annual fee |
|---|---|---|
| Tier 1 (micro organisations) | Maximum turnover of £632,000, or no more than 10 members of staff | £52 |
| Tier 2 (small and medium organisations) | Maximum turnover of £36 million, or no more than 250 members of staff | £78 |
| Tier 3 (large organisations) | Those that don't meet tier 1 or tier 2 | £3,763 |
You get £5 off if you pay by direct debit. Sources: GOV.UK: Pay the data protection fee and ICO: Guide to the data protection fee. Some organisations are exempt, for example some that only process personal data for staff administration, advertising their own business, or keeping accounts and records. The self-assessment tells you for sure.
Privacy notice
If you collect personal data, for example through a booking form, a mailing list or your website, you must tell people who you are, what data you collect, why, how long you keep it, who you share it with and their rights. Put this in a privacy notice on your website and link to it wherever you collect data. The ICO has a privacy notice generator for small businesses on its small business hub: ICO: Advice for small organisations.
Cookies on your website
If your website sets cookies or similar technologies that aren't strictly necessary (most analytics and advertising cookies), you must tell users and usually get their consent before setting them. Source: ICO: Cookies and similar technologies.
Email and text marketing
Sending marketing emails or texts to individuals generally needs their consent, and you must always give a simple way to opt out. There are different rules for business contacts and for existing customers. The ICO explains them in its direct marketing guidance, linked from ICO: Advice for small organisations.
Keeping data secure
- Use strong, unique passwords and two-step verification on email, banking, cloud storage and software.
- Keep devices and software updated, and encrypt laptops and phones.
- Lock away paper records and shred what you no longer need.
- Only give staff access to what they need.
- Know what to do if data is lost or stolen: some breaches must be reported to the ICO within 72 hours.
Licences and permits
Many activities need a licence, permit or registration, usually from your local council. Examples include selling food or alcohol, street trading, running a taxi, hairdressing and beauty treatments in some areas, playing music in public, animal businesses and waste carrying. Use the GOV.UK GOV.UK: Licence finder to see what applies to your business and where you are.
Food businesses must register with their local council at least 28 days before starting to trade. Source: GOV.UK: Register a food business.
Business rates
If you use a non-domestic property, such as a shop, office or workshop, you may have to pay business rates. Source: GOV.UK: Business rates. You won't pay business rates on a property with a rateable value of £12,000 or less if it is your only property and you get small business rate relief; relief tapers for rateable values between £12,001 and £15,000. Source: GOV.UK: Small business rate relief. Working from home doesn't usually mean paying business rates, but check if you've made changes or see customers there.
Checklist
- Work out what personal data you hold and why.
- Take the ICO fee self-assessment and pay if required.
- Publish a privacy notice and a cookie banner if needed.
- Get consent for marketing emails and texts.
- Secure your devices, accounts and paper records.
- Use the licence finder and register with your council if needed.
- Check business rates and small business rate relief if you have premises.
See also our legal setup guide and websites & domains page.
Official sources
- GOV.UK: Data protection in your business
- ICO: Advice for small organisations
- ICO: Data protection fee self-assessment
- GOV.UK: Pay the data protection fee
- ICO: Guide to the data protection fee
- ICO: Cookies and similar technologies
- GOV.UK: Licence finder
- GOV.UK: Business rates
- GOV.UK: Small business rate relief
Free official help and our tools
- GOV.UK: Business and self-employed
- British Business Bank: Business guidance
- Start Up Loans: Support and guidance
- Our card reader fee calculator
- Our Find my card reader quiz
More free guides
- Pricing for profit
- Separating business and personal money
- HMRC deadlines and Companies House basics
- Marketing on a small budget
- Legal setup
← Back to Running your business Try the fee calculator
Last checked 29 October 2026. Spotted something out of date? Let us know.