Nookward Compliance / Practical guide
GDPR and data protection for small employers.
A reassuring starting point for UK employers with 5–50 staff. Recruitment, payroll, references, monitoring and health and safety records all involve people’s information. A proportionate approach starts with knowing why you use it, who can access it and when to delete it.
Your size changes the paperwork, not the duty.
If your organisation processes personal data about people in the UK, data protection law applies whether you have 5 staff or 5,000. The UK GDPR continues after Brexit and is read alongside the Data Protection Act 2018. The rules ask you to handle information fairly and responsibly, not to create paperwork for its own sake.
The ten principles to keep in view are:
- Lawfulness — have a valid reason for each use.
- Fairness — use information in ways people would reasonably expect.
- Transparency — explain what you do with it.
- Purpose limitation — use it for clear, specified purposes.
- Data minimisation — collect only what you need.
- Accuracy — keep information correct and up to date.
- Storage limitation — do not keep it longer than needed.
- Integrity — protect it against loss or unauthorised change.
- Confidentiality — keep it secure and limit access.
- Accountability — take responsibility and be able to show it.
Official sources: ICO: Data protection principles and key terms · UK GDPR, Article 5 · Data Protection Act 2018
The under-250 record exemption is limited.
Employers with 5–50 people fall within the UK GDPR’s fewer-than-250 category, but are not generally exempt from UK GDPR. The limited exemption concerns records of processing. You still need to document processing that is not occasional, is likely to risk people’s rights and freedoms, or involves special-category data or criminal conviction and offence data. Regular payroll and recruitment, for example, are not occasional.
A controller decides why and how personal data is used. A processor handles it for a controller, usually on the controller’s instructions. Both have responsibilities, but controllers generally have more extensive records to keep. A supplier’s role depends on what it actually does with the information, not just the label in a contract.
A useful first pass is to write down your regular people-data activities and any occasional activity that is high-risk or uses special-category or criminal-offence data.
Official sources: ICO: Who needs to document processing activities? · ICO: Controllers and processors · UK GDPR, Article 30
Give each employment purpose a lawful basis.
Be clear about why you need each item of information. Payroll, recruitment, references, workplace monitoring and health and safety records are different purposes, so check the lawful basis that applies to each one before processing it.
Contract necessity is narrower than “useful for work”: it applies only when the processing is necessary to perform the employment contract, or to take specific pre-contract steps requested by the person. If a legal obligation is the real reason, assess that basis instead.
Health information is special-category data. You need an Article 6 lawful basis and an additional Article 9 condition, and some conditions also require safeguards under the Data Protection Act 2018. Consent is not automatically the right employment basis: because of the power imbalance, a worker may not feel free to refuse. Use consent only where there is a genuine choice and it can be withdrawn without disadvantage.
Official sources: ICO: Collecting and keeping employment records · ICO: Workers’ health information · UK GDPR, Article 6 · UK GDPR, Article 9
Map the work, then explain it to employees.
Make a simple map of your regular processing: what information you use, whose it is, each purpose and lawful basis, who it is shared with, the risks, how long you keep it, and how you will securely dispose of it. Record your purposes and describe them in the privacy information you give employees and applicants.
Employees’ data rights do not disappear because your organisation is small. Depending on the circumstances and the rules for each right, they may ask to access their data, correct it, have it erased, receive portable data, or object to its use. Make sure someone knows how to recognise and handle these requests.
If an external payroll, HR or cloud provider processes personal data on your behalf, put a written processor contract in place. It should define the processing and set out obligations such as following your instructions, keeping data secure, helping with people’s rights, and returning or deleting information at the end of the service.
The ICO’s Accountability Framework, now its Accountability toolkit, and its small-organisation resources can help structure a practical self-check. They are a starting point, not a guarantee that every legal requirement is met.
Official sources: ICO: Individual rights · ICO: Contracts with processors · UK GDPR, Article 28 · ICO: Data protection audit framework and Accountability toolkit · ICO: Advice for small organisations
Check risk before a major data project.
A data protection impact assessment (DPIA) is required before processing that is likely to create a high risk to people. There is no small-employer exemption. ICO guidance says that, in most cases, two or more of its nine high-risk criteria indicate a DPIA is needed; one criterion can be enough in a particular situation.
Even where a DPIA is not mandatory, it is good practice for a major project involving personal data. Consider one for a new recruitment system or monitoring tool, large-scale or sensitive-data use, profiling, or work involving vulnerable people. Assess the likely impact, reduce risks where you can, and record the decision before the project begins.
Official sources: ICO: When do we need to do a DPIA? · ICO: Data protection impact assessments · UK GDPR, Article 35
Have a calm, quick breach response.
If information is lost, sent to the wrong person or accessed without permission, act promptly. Establish the facts and scope, contain the incident, assess the risk to people, and record what happened, what you did and why you did or did not notify.
Under UK GDPR, notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware if the breach is likely to result in a risk to people’s rights and freedoms. Give the essential information available, then follow up with anything still being investigated. Tell affected people without undue delay if the risk to them is high. Keep an internal record of every breach, including incidents you do not report.
There is a separate PECR rule for relevant communications service providers. Following the Data Use and Access Act 2025, their notification is due within 72 hours of becoming aware of the essential facts, where feasible. The fixed £1,000 penalty relates to a provider’s failure to meet that PECR notification duty. It is not a general UK GDPR fine for every employer.
Official sources: ICO: Personal data breaches · UK GDPR, Article 33 · ICO: PECR security breaches for service providers · Data Use and Access Act 2025, section 111 · Privacy and Electronic Communications Regulations 2003, regulations 5A and 5C
Headcount alone does not require a DPO.
A Data Protection Officer (DPO) is mandatory if you are a public authority or body, or if your core activities involve either large-scale, regular and systematic monitoring of people, or large-scale processing of special-category or criminal-conviction and offence data. The criteria focus on what the organisation does, not a 5–50-person headcount.
If a DPO is required or you choose to appoint one, the role can be shared across a group, assigned to an existing employee whose other duties do not create a conflict, or provided externally. The DPO must be independent, adequately resourced and report to the highest relevant management level.
Official sources: ICO: Data protection officers · UK GDPR, Article 37