GDPR compliance is one of the most misunderstood areas of digital business for UK SMEs. Most businesses either ignore it (hoping for the best) or over-engineer compliance to the point of friction that damages user experience. The reality sits in the middle: UK GDPR requires genuine respect for data privacy, clear communication with users, and lawful grounds for processing — but it is achievable for any business without specialist lawyers or enterprise-grade compliance software. Note: this article provides general guidance only and is not legal advice. Consult a qualified legal professional for advice specific to your situation.
UK GDPR vs EU GDPR: The Key Difference
After Brexit, the UK retained the GDPR framework as UK GDPR, incorporated into the Data Protection Act 2018. For most UK businesses operating solely within the UK, the practical requirements are nearly identical to EU GDPR. The significant difference: if you process data of EU residents, you may need to comply with EU GDPR as well, which could require an EU-based representative. The ICO (Information Commissioner's Office) is the UK supervisory authority — it publishes practical guidance and is the body that investigates complaints and issues fines.
The Six Lawful Bases for Processing Personal Data
Every time you collect or process personal data, you need a lawful basis. There are six under UK GDPR:
- Consent — The individual has given clear, specific, informed, and unambiguous consent. Must be freely given (not a condition of service). Consent can be withdrawn at any time. Most appropriate for marketing emails and non-essential cookies.
- Contract — Processing is necessary to fulfil a contract with the individual. Appropriate for processing order details, delivery addresses, and billing information.
- Legal obligation — Processing is required by law. Payroll records, tax records, and anti-money laundering checks fall here.
- Vital interests — Processing is necessary to protect someone's life. Rarely applicable to most businesses.
- Public task — Processing is necessary for a task in the public interest. Applies primarily to public bodies.
- Legitimate interests — Processing is necessary for your legitimate interests or those of a third party, provided those interests are not overridden by the individual's rights. The most flexible basis — applicable to fraud prevention, security, some direct marketing, and business analytics — but requires a Legitimate Interests Assessment (LIA) to document your reasoning.
Your Website and GDPR
Privacy Policy
Every website collecting any personal data must have a privacy policy. It must explain: what data you collect, why you collect it, the lawful basis for each type, how long you keep it, who you share it with, and the individual's rights. It must be written in plain language and easily accessible — a link in the footer of every page is standard.
Cookie Consent
Non-essential cookies (analytics, advertising, social media trackers) require explicit consent before being set. This means a cookie banner that does not pre-tick boxes, does not use dark patterns ("Accept All" button prominent, "Reject" buried), and gives users a genuine choice. Strictly necessary cookies (session management, shopping cart) do not require consent. The ICO has been increasingly active on cookie compliance — basic analytics without consent is a real risk.
Contact Forms
Contact forms must not collect data beyond what is necessary. If you are collecting name and email to respond to an enquiry, that is proportionate. Adding date of birth or telephone number "just in case" violates the data minimisation principle. The form should link to your privacy policy so users know how their data will be used.
Email Marketing and Consent
Sending marketing emails to individuals (B2C) requires prior consent under PECR (Privacy and Electronic Communications Regulations), which sits alongside UK GDPR. Consent must be specific, informed, and documented. Pre-ticked boxes are not valid consent. "Soft opt-in" applies where a customer has recently purchased a similar product or service — you can market similar products to them without separate consent, provided you gave them the chance to opt out at the time of purchase and on every subsequent communication.
B2B email marketing (to corporate email addresses) operates under slightly different rules — you need to identify yourself, give a valid address, and provide an opt-out mechanism, but prior consent is not strictly required in all cases. Keep accurate records of when and how consent was obtained.
Data Subject Rights You Must Honour
Individuals have the following rights under UK GDPR. Requests must be responded to within one month:
- Right of access — Individuals can request a copy of all personal data you hold about them (a Subject Access Request)
- Right to erasure — "The right to be forgotten" — individuals can request deletion of their data in certain circumstances
- Right to rectification — Individuals can request correction of inaccurate data
- Right to data portability — Individuals can request their data in a portable format
- Right to object — Individuals can object to processing based on legitimate interests or for direct marketing
Data Breaches
If a data breach occurs that poses a risk to individuals' rights and freedoms, you must notify the ICO within 72 hours of becoming aware of it. If the breach is high risk, you must also notify the affected individuals without undue delay. Document all breaches, even those you decide not to report, in your internal breach register.
Key Takeaway
UK GDPR compliance for most SMEs comes down to four practical priorities: a clear privacy policy, proper cookie consent implementation, documented lawful basis for each type of data processing, and a process for handling data subject requests within the required timeframe. Register with the ICO (required for most organisations processing personal data — annual fee from £40), implement a compliant cookie banner, and review your privacy policy annually. These steps address the vast majority of compliance risk for a typical UK business.
Final Thoughts
UK GDPR compliance is not about perfection — it is about demonstrable good faith and genuine respect for individuals' data rights. The ICO's enforcement focus is typically on serious breaches, systemic non-compliance, and organisations that ignored clear obligations rather than businesses making reasonable efforts. Start with the fundamentals, document your decisions, and treat data privacy as an ongoing responsibility rather than a one-time project. If you are in doubt about specific situations, the ICO's online guidance is comprehensive and freely available.