GDPR without the headache

Most small business owners know they should "sort out GDPR" on their website, but few are quite sure what that involves. Here's the reassuring part: for a typical small business site, getting the basics right is mostly about being honest and tidy. You need to know what personal data you collect, have a sensible reason for holding it, look after it properly and explain it clearly to the people who hand it over. No consultants required for the fundamentals.

This guide walks through the practical steps, in the order you'll actually tackle them.

Start by listing the personal data you collect

Personal data is any information that can identify a living person — a name, an email address, a phone number, an IP address, even a photo. Before you write a single policy, get a clear picture of what your website gathers. Sit down with a brew and go through your site page by page.

• Contact and enquiry forms — names, emails, phone numbers and anything typed into a message box.
• Newsletter sign-ups — email addresses, and often first names and preferences.
• Booking or quote tools — addresses, dates, job details and sometimes payment information.
• Analytics and cookies — IP addresses, device types, pages visited and how long people stayed.
• Server logs — your hosting provider usually records IP addresses and timestamps automatically.
• Social feeds, chat widgets and comment boxes — often quietly collecting data in the background.

The last two catch people out. If a tool sits on your site, it's probably collecting something, even if you never look at it.

Be clear about why you need it

Every piece of personal data needs a reason — GDPR calls this a lawful basis. In practice, most small businesses rely on one of these:

• Consent — they ticked a box or opted in, and they can withdraw that choice at any time.
• Contract — you need the details to deliver something they've bought or booked.
• Legitimate interests — you have a sensible, expected reason, such as replying to an enquiry, and it doesn't override their rights.
• Legal obligation — you have to keep records, for example for tax purposes.

The test is simple: could you explain to a customer why you need each field, without wincing? If not, stop collecting it. Extra fields added "just in case" are one of the most common and most easily fixed problems we see. Ask yourself how long you genuinely need to keep things, too, and delete what's past its usefulness.

Write a privacy notice people can actually read

A privacy notice isn't a legal dumping ground. It's a plain-English explanation of what happens to someone's information. Keep it to about a page, link to it in your footer so it appears on every page, and make sure it covers:

• Who you are and how to contact you.
• What you collect and why.
• The lawful basis for each use.
• Who else sees it — your host, email provider, booking platform or accountant.
• How long you keep it.
• The rights people have, including asking for a copy or deletion.
• How to complain to the UK's data protection regulator if they're unhappy.

Write it the way you'd explain it on the phone. "We keep your enquiry for two years so we can pick up where we left off" beats three paragraphs of legalese every time.

Sort out cookies and analytics

Cookies that aren't strictly necessary — analytics, advertising, embedded videos and social buttons — need consent before they run. That means a banner where "reject" is as easy to find as "accept", no pre-ticked boxes, and no loading the tracking scripts first and asking afterwards. If someone says no, respect it and don't nudge them again on every page.

It's worth auditing your plugins and embeds with this in mind. A single forgotten tracking pixel can undo a lot of good work elsewhere.

Keep it tidy as you go

Compliance isn't a one-off job you finish and forget. A handful of habits will keep you on the right side of things:

• Make sure your site runs over HTTPS so form data is encrypted in transit.
• Limit who can see customer data — share logins sparingly and remove access when someone leaves.
• Check whether you need to pay the annual data protection fee to the regulator; many small businesses do.
• Keep a short record of what you hold and why, even if it's just a simple spreadsheet.
• Review your notice and your forms once a year, or whenever you add a new tool.

None of this needs to be intimidating. Treat people's information the way you'd want yours treated, explain it honestly, and you'll be doing the important ninety per cent well.