The Afternoon Data MOT: Getting Your Small Business GDPR-Ready Before a Client Asks

Your biggest client has just sent over a supplier questionnaire. Somewhere between the insurance certificate and the modern slavery statement, there is a line about data protection: please confirm you comply with UK GDPR. You do not have a compliance team. You have a laptop, a CRM, an accountant and a growing to-do list. Deep breath. You do not need a perfect data protection programme to answer sensibly. You need a one-page MOT: a short, honest check of the basics, a few fixes, and evidence that you take customer data seriously. Set aside an afternoon. Here is how to spend it.

Start with a one-page data map

Before you touch a template, write down what personal data you actually hold. Customer names and emails, invoice addresses, delivery details, payroll information, website enquiries, marketing lists, CCTV footage, call recordings, freelancer bank details. For each one, note where it lives, why you have it, who sees it and how long you keep it. A spreadsheet is fine. The aim is not a work of art; it is to spot the data you do not need. If you have been hoarding old enquiries for years, that is an easy win: delete what you cannot justify.

Check your privacy notice is not a museum piece

Your website privacy notice should match what you actually do in 2026, not what you did when the site was built. It needs to say who you are, what data you collect, why you collect it, your lawful basis, who you share it with, how long you keep it, and how people can exercise their rights. It should also mention the right to complain to the ICO and give a contact route. If you use a new CRM, mailing tool or payment provider, check the notice still tells the truth. No website? Put a short privacy statement in your proposals and client contracts.

Name your lawful basis

For each processing activity, pick a lawful basis and write it down. Most customer admin will be contract: you need the details to deliver what they bought. Payroll and tax records usually rely on legal obligation. Marketing emails need consent or the soft opt-in, depending on how you got the address. Legitimate interests can work for some business-to-business activity, but you need a short balancing note. Avoid the classic mistake of saying you rely on consent for everything. It is usually untrue, and it makes life harder when someone withdraws consent.

Decide when to bin data

Retention is where many small firms wave vaguely at the filing cabinet. Create a simple retention schedule: customer records, enquiry records, payroll, tax records, marketing lists, CCTV. Check HMRC record-keeping rules for the financial stuff; business records often need to be kept for around six years, and some need longer. For marketing data, remove inactive contacts after a reasonable period. Put a recurring calendar reminder in place to delete what has expired. A deletion you can evidence is worth more than a policy nobody follows.

Have a route for subject access requests

Someone can ask for a copy of their personal data at any time. You have one month to respond, though complex requests can be extended by two further months. Verify identity if necessary, search the places in your data map, redact other people’s information, and reply clearly. You generally should not charge a fee. Keep a template acknowledgment and a checklist. The worst outcome is not a difficult request; it is a request that sits in an inbox because nobody knew who owned it.

Keep simple records

A record of processing activities sounds grand. In practice, it can be the same spreadsheet as your data map, with columns for activity, data types, purpose, lawful basis, recipients, retention and security. Many small businesses are exempt from the formal Article 30 requirement, but a simple record still helps you answer client questionnaires and spot gaps. Add a processor list: email host, CRM, accountant, payroll provider, website host. Make sure you have the right contract terms in place. Then cover the basics: two-factor authentication, updates, limited admin access, backups and a clear way to report a suspected breach. Keep a breach log, even if it is empty.

The client-contract pre-flight

Before you sign a new client contract, check three things. First, are you a controller or a processor for the client data? If the client is the controller and you are handling data on their behalf, you need a data processing agreement. Second, does your privacy notice cover the new work? Third, can you answer the security questions honestly? Do not promise encryption everywhere if you have not switched it on. A short security summary, a processor list and a named contact will satisfy most sensible clients.

Your afternoon checklist

• Write your one-page data map and delete anything you cannot justify.
• Update the privacy notice and check every tool you use.
• Record a lawful basis for each main activity.
• Set retention periods and a deletion reminder.
• Create a subject access request template and owner.
• List processors and check contract terms.
• Switch on two-factor authentication and review admin access.
• Save your evidence in one folder called Data Protection MOT 2026.

At Click4Advice, we would call that a result. You have not become a compliance department. You have built a defensible, practical record of how you handle data, and you can answer the next client questionnaire without bluffing. Review it once a year, or whenever you change tools. This is general guidance, not legal advice; if you handle sensitive data or large volumes, get a specialist to check your approach.