When a UK business needs specialist data-protection advice
Katerina Galkina · EN · 07/10/2026
Читать на русскомMap your information first
List what personal information the business collects, why, where it is stored and who receives it. Include booking forms, payments, marketing, staff, cameras, cloud services and contractors. Identify health, children’s and other sensitive information.
For straightforward processes, start with ICO tools for small organisations ↗. They help frame useful questions instead of buying a generic GDPR package unrelated to your operations.
When individual advice helps
Seek specialist input before launching complex profiling, medical-data sharing, international transfers or a platform handling substantial customer information. Advice can also help with access requests, supplier disputes and uncertain use of customer lists for advertising.
Describe the process, countries, suppliers and decision you need. Request concrete deliverables: a risk assessment, changes, processor agreement or response plan. Technical security and legal documentation may require different specialists.
Is a DPO compulsory?
A small business does not need a Data Protection Officer simply because it has a customer list. ICO criteria ↗ include core activities involving large-scale regular and systematic monitoring or large-scale special-category processing.
Assess your activities and record the conclusion. Not needing a DPO does not remove other obligations. Voluntary appointment also brings requirements; do not use the title as a decorative signature. ICO is reviewing some guidance following the Data (Use and Access) Act, so check its current explanations.
If a breach has already occurred
Restrict exposure, record facts and assess the risk to people. ICO’s first-72-hours guidance ↗ explains that a breach meeting the reporting threshold must be notified without undue delay and within 72 hours of discovery.
Do not wait for a consultant’s contract before documenting and containing the incident. When choosing a lawyer, check relevant experience, credentials, scope, confidentiality and the complete price. For a solicitor in England and Wales, use the SRA register ↗; other UK nations have their own regulators. Neither a template nor an adviser replaces carrying out the agreed actions.