How to handle personal data properly under UK GDPR.

This is general information, not legal advice. Data protection law in the UK is being updated, including through the Data (Use and Access) Act 2025, so check current guidance from the Information Commissioner’s Office (ICO).

Why it matters

Almost every tech startup processes personal data: users, customers’ staff, website visitors, job applicants. UK GDPR and the Data Protection Act 2018 set the rules, and the ICO enforces them. In practice, the first pressure usually comes from customers rather than the regulator: enterprise buyers send security and data protection questionnaires before they sign. Getting the basics right shortens sales cycles as well as reducing risk.

Controller or processor

You are a controller when you decide why and how personal data is used, for example your own marketing list or user accounts. You are a processor when you handle personal data on a customer’s instructions, as most B2B SaaS products do with their customers’ data. Many tech startups are both, for different data, and the obligations differ.

Step by step

1. Pay the data protection fee. Most organisations that process personal data must pay an annual fee to the ICO unless an exemption applies. The ICO has a short self-assessment on its website.
2. Map your data. List what personal data you hold, where it comes from, where it is stored, who you share it with and how long you keep it. A spreadsheet is fine. This becomes your record of processing.
3. Choose a lawful basis for each use. UK GDPR has six: consent, contract, legal obligation, vital interests, public task and legitimate interests. Most product data relies on contract; much B2B marketing and analytics relies on legitimate interests, which needs a short documented balancing test. Do not default to consent when another basis fits better.
4. Publish an accurate privacy notice. Explain what you collect, why, the lawful basis, who receives it, international transfers, retention and people’s rights.
5. Sign data processing agreements. Article 28 of UK GDPR requires a written contract between controllers and processors. Offer customers your own DPA, and make sure you have DPAs with your sub-processors, such as hosting, email and analytics providers. Keep a public list of sub-processors.
6. Handle international transfers. If personal data leaves the UK, you need a transfer mechanism, such as an adequacy decision or the UK’s international data transfer agreement or addendum.
7. Get cookies right. Under the Privacy and Electronic Communications Regulations, non-essential cookies have generally needed consent, and recent changes create some exceptions. Check current ICO guidance rather than copying another site’s banner.
8. Be ready for rights requests and breaches. Have a simple process for subject access and deletion requests. Some personal data breaches must be reported to the ICO within 72 hours of becoming aware of them, so know who decides and how.
9. Assess high-risk processing. If you use new technology, such as AI, on personal data at scale, or process health or other special category data, a data protection impact assessment is likely to be required.

Worked example

Brightnest, a Cardiff HR software company, keeps losing time on customer security questionnaires. Over a fortnight it maps its data, confirms it pays the ICO fee, publishes a sub-processor list, adopts a standard DPA, documents a legitimate interests assessment for its marketing, and writes a one-page breach procedure. It then builds a reusable answer bank. The next questionnaire takes two hours instead of two weeks, and a data protection solicitor reviews the DPA once rather than for every deal.

Common mistakes

• A privacy policy copied from another company that describes processing you do not do.
• Using production customer data in test environments without controls.
• Adding new tools that process personal data without a DPA or adding them to the sub-processor list.
• Treating consent as the only lawful basis.
• No owner for breach decisions, so the reporting deadline passes.

What to measure

• Percentage of sub-processors with a signed DPA.
• Average time to complete a customer security questionnaire.
• Time taken to respond to subject access requests against the legal deadline.