Free GDPR checklist for UK small businesses

Getting compliant, step by step

There is no GDPR certificate — compliance is a habit, not a badge. These ten stages take you from “we hold data” to a routine you can keep up. Each one says what to do and what to keep as proof. Times are typical for a small firm, not a promise.

1. Know your data

   • Write down what personal data you hold

     List what you hold, where it lives, who can see it and why you have it: customers, staff, suppliers, marketing lists. A spreadsheet is fine.

     What to do:

     1. Open a blank spreadsheet or a sheet of paper.
     2. List each set of personal data you hold: customers, staff, suppliers, marketing lists.
     3. Next to each, write where it lives — for example, your email, accounts software or a filing cabinet.
     4. Write who can see it and why you have it.
     5. Put one person's name against each set as its owner.

     Keep as proof: A record of what you hold, with an owner for each set of data.

     Typical: A weekStart with the free GDPR checklist

   • Decide your lawful basis for each use

     For each use of personal data, note why the law allows it: a contract, a legal duty, legitimate interest, or consent. Marketing usually needs consent or a soft opt-in.

     What to do:

     1. Take the data record from the last stage.
     2. For each use of data, ask: why does the law let us do this?
     3. Write the reason next to it — a contract, a legal duty, legitimate interest, or consent.
     4. For marketing emails, make sure you have consent or a soft opt-in, and note where it was given.

     Keep as proof: A lawful basis noted against each use in your data record.

     Typical: A few daysCheck your answers in the free checklist

   • Check whether you must register with the ICO

     Most UK businesses that handle personal data must pay the ICO data protection fee. Check the ICO's self-assessment, register if needed, and diarise the annual renewal.

     What to do:

     1. Go to the ICO website and find the registration self-assessment.
     2. Answer its questions about your business.
     3. If it says you must register, follow the link to register and pay the fee.
     4. Write your registration number (or why you are exempt) in your data record, and diarise the annual renewal.

     Keep as proof: Your ICO registration number, or a note of why you are exempt.

     Typical: Half an hourThe checklist reminds you of this

2. Put the paperwork in place

   • Publish a privacy notice

     Tell people, in plain words, what you collect, why, how long you keep it and who you share it with. Put it on your website and give it to staff.

     What to do:

     1. Open the free templates using the link below and download the privacy notice.
     2. Fill in your company name, what you collect and why.
     3. Say how long you keep each type of data and who you share it with.
     4. Put the finished notice on your website and email it to staff.

     Keep as proof: A published privacy notice with a review date.

     Typical: A dayPrivacy notice template

   • Write your data protection policy and retention schedule

     A short policy on how you protect personal data, and a schedule saying how long each type of data is kept before it is deleted.

     What to do:

     1. Open the free templates using the link below.
     2. Download the data protection policy and fill in your details.
     3. Download the retention schedule and say how long each type of data is kept.
     4. Get the owner to sign and date both, and name who owns each document.

     Keep as proof: Both documents, dated, with a named owner.

     Typical: A weekPolicy and retention templates

   • Check your contracts with suppliers who handle data for you

     Payroll bureaus, email marketing tools, cloud hosts — anyone processing personal data on your behalf needs a contract with the required data protection clauses.

     What to do:

     1. List every supplier that handles personal data for you — payroll, email marketing, cloud hosting and so on.
     2. For each one, find the contract or terms you signed.
     3. Check it includes data protection clauses — most big suppliers' standard terms do.
     4. Write down what you found against each supplier; chase any that are missing.

     Keep as proof: A list of your processors and the contract terms for each.

     Typical: A week or twoTrack it in the free checklist

3. Run it day to day

   • Train everyone who touches personal data

     A short session when people join and a yearly refresher: spotting phishing, locking screens, reporting mistakes quickly. Kept's free staff training covers the basics.

     What to do:

     1. Open the free staff training using the link below.
     2. Send the link to everyone who handles personal data.
     3. Ask each person to finish the lessons and pass the short quiz.
     4. Write down who completed it and when, and repeat once a year.

     Keep as proof: A list of who completed training and when.

     Typical: A weekFree staff training

   • Be ready for requests from individuals

     People can ask for a copy of their data, or ask you to correct or delete it. You normally have one month to reply. Have a simple procedure so nothing gets missed.

     What to do:

     1. Open the free templates using the link below and download the subject access procedure.
     2. Fill in who in your business handles these requests.
     3. Decide where requests are logged — a simple spreadsheet is fine.
     4. Tell staff to forward any request to the named person the day it arrives.

     Keep as proof: A written procedure and a log of any requests received.

     Typical: A day to set upSubject access procedure template

   • Have a breach plan before you need it

     Decide now who does what if personal data is lost or stolen. Serious breaches must be reported to the ICO within 72 hours, so the plan cannot wait until the day.

     What to do:

     1. Open the free templates using the link below and download the breach plan.
     2. Fill in who to call first and who decides whether to report.
     3. Add the ICO's reporting details and the 72-hour rule.
     4. Share the plan with staff and keep a blank breach log ready.

     Keep as proof: A written breach plan with named contacts, plus a breach log.

     Typical: A dayBreach plan template

4. Review and improve

   • Review everything once a year

     Re-run the readiness check, refresh the data record, renew the ICO fee and retrain staff. Diarise it — compliance drifts when nobody looks.

     What to do:

     1. Put a yearly date in the diary — the ICO renewal date is a good prompt.
     2. Re-run the free checklist using the link below and compare with last year.
     3. Update the data record for anything new or removed.
     4. Renew the ICO fee and retrain anyone due a refresher.

     Keep as proof: A dated annual review note and an updated data record.

     Typical: A day a yearRe-run the free checklist

Growth customers can tick these off as they go in their Kept workspace. See the plans.