Information security and UK GDPR basics for tech startup operations.

A data breach or ransomware attack can end a small tech company: lost customer trust, regulatory action, lost time and sometimes lost data. Larger customers will also ask security questions before they buy, and some public sector contracts require certification. Getting the basics right is not expensive, but it does need an owner.

This guide is general information, not legal or security advice. Rules and guidance change; check the ICO and the National Cyber Security Centre for current guidance.

Security basics

The government-backed Cyber Essentials scheme is built around five technical controls, which make a sensible baseline for any small company:

• Firewalls: protect your internet connection and devices.
• Secure configuration: remove default passwords and unused software and accounts.
• User access control: give people only the access they need, and use separate administrator accounts.
• Malware protection: on every device that can be protected.
• Security update management: keep operating systems and software up to date.

Add to these: two-factor authentication on every business account, a company password manager, encrypted laptops, regular tested backups, and a starter and leaver process for access.

Cyber Essentials certification

There are two levels. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds hands-on technical testing by an assessor. Certification must be renewed each year. It is required for some central government contracts, and many larger customers ask for it. For a small tech startup with a modern cloud setup, preparing for the basic level is usually manageable in a few weeks.

UK GDPR duties in operations

1. Know what personal data you hold. Keep a simple record: what data, about whom, why, where it is stored, which suppliers process it and how long you keep it.
2. Have a lawful basis for each use, and a clear privacy notice on your website and product.
3. Pay the data protection fee to the ICO if required; most organisations processing personal data must, unless exempt. Check the ICO site for current tiers.
4. Put contracts in place with suppliers that process personal data for you, and check where they store it.
5. Handle requests from individuals. People can ask for a copy of their data; you generally have one month to respond. Have a short process and a named owner.
6. Prepare for breaches. If a personal data breach is likely to put people’s rights and freedoms at risk, you must report it to the ICO within 72 hours of becoming aware of it. Write a short incident plan now: who decides, who investigates, who contacts the ICO and customers.
7. Keep data only as long as needed and delete it on a schedule.

Email marketing has its own rules under the Privacy and Electronic Communications Regulations; see the ICO guidance and the legal playbook.

A worked example

Ravensworth Learning, a fictional Birmingham tech startup selling training software to councils, was asked for Cyber Essentials during a tender. It had no device policy and three former contractors still had access to its cloud console.

Over five weeks it enabled two-factor authentication everywhere, removed old accounts, encrypted all laptops, set automatic updates and wrote a one-page incident plan. It passed Cyber Essentials and later moved to Cyber Essentials Plus as contracts grew.

Common mistakes

• Shared logins and passwords stored in chat messages.
• Production customer data copied to laptops or test environments.
• Backups that have never been restored to check they work.
• No plan for a breach until it happens.

What to measure

• Share of accounts with two-factor authentication.
• Devices with current updates and encryption.
• Days to remove leavers’ access.
• Last successful backup restore test.
• Requests from individuals answered on time.