- A privacy notice saying what you hold, why, and how long you keep it
- A lawful basis for holding it, which for most trade work is contract or legitimate interests rather than consent
- Storage that is not a shared spreadsheet on an open laptop
- A process for a subject access request, which you normally have one month to answer
- A data breach process, since a breach that risks people's rights must reach the ICO within 72 hours of you becoming aware of it
- A way to handle data protection complaints, which has been required since 19 June 2026
- Registration with the ICO and the annual data protection fee, which most businesses holding customer data owe
The phone. Photographs of customer property on an unlocked personal device is the weak point. Passcode and encryption, today.
The ICO fee. Holding customer data this way almost certainly means you owe the annual data protection fee. It is small and not paying it is an easy thing to be fined for.
Then three things to write down once: a privacy notice for your website, your lawful basis, which for you is contract, and how long you keep photos before deleting them.
Deletion is the one nobody does. Want me to draft the privacy notice?
It flagged the fee, which is the cheapest fine to avoid and the most commonly missed.
The core duties
UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, apply to any business holding personal data. Answer a subject access request without undue delay and normally within one month. Report a breach to the ICO without undue delay and, where feasible, within 72 hours, unless it is unlikely to risk people's rights. Since 19 June 2026 you must also have a process for data protection complaints. As of Oct 2026.
UK GDPR Arts 12 and 33; Data (Use and Access) Act 2025 s.76; SI 2026/82 regs 2 and 3
The ICO data protection fee
£52 a year for tier 1, £78 for tier 2 and £3,763 for tier 3, with £5 off by direct debit. Tier 1 covers turnover up to £632,000 or no more than 10 staff, which is most small businesses. If you only process data for staff administration, your own marketing and your accounts, you may be exempt: run the ICO's self-assessment to check. As of Oct 2026.
Data Protection (Charges and Information) Regulations 2018, as amended from 17 February 2025
Marketing emails and texts
Marketing by email or text to individuals needs their consent, or the soft opt-in for existing customers buying similar services, with an easy way to opt out. For breaches on or after 5 February 2026, the maximum fine reaches £17.5 million or 4% of worldwide turnover, whichever is higher. As of Oct 2026.
Privacy and Electronic Communications Regulations 2003 reg 22; Data (Use and Access) Act 2025
Data you no longer hold cannot be breached, requested or fined. Deletion is the step nobody does.
The ICO fee is the one people forget. It is small, it is annual, and not paying it is an easy thing to be fined for.
I hold [what data, for example customer names, addresses, photos of their properties] for a [type of business] in the UK. I store it in [where] and I [do or do not] send marketing emails. Tell me what I am actually required to do, whether I owe the ICO fee, and draft me a privacy notice.
Every lesson ends with a question to hand to a Greymill specialist, who answers with what it knows about your business.
More in Rules, data and risk
- Which rules actually apply to youThe short list, not the whole library.Read the lesson
- Holding customer dataThere is no single federal privacy law, which makes this harder rather than easier.Read the lesson
- Being able to prove itDoing the right thing and being able to show it are two different jobs.Read the lesson