UK GDPR help for small businesses that just want it clear
UK GDPR asks you to know what personal data you hold, why you hold it and how long you keep it. We help you turn that into plain records and habits. This is practical help, not legal advice.
Who this is for
For owners who know GDPR applies to them but have never sat down with it. Your privacy notice was copied from somewhere, your mailing list came from several places, and you would not know where to begin if a customer asked what you hold about them.
Where small businesses get tangled up in data protection
Jargon that stops you starting
Controller, processor, lawful basis, legitimate interests. You nod, file it for later, and the privacy notice on your site stays a copy of somebody else's.
The marketing consent muddle
You are unsure when you can email a list, what a past customer agreed to, or whether the spreadsheet from a trade show is usable. Electronic marketing has its own rules too.
A request for all their data
Someone asks for everything you hold about them. The clock is a month, and their details are spread across email, messaging apps and three tools. Where do you even look.
No record of your decisions
If the ICO or a customer asks how you decided something, nothing is written down. That is not always a breach, but it makes every question harder to answer.
Getting data protection written down and workable
Scope &
Strategy
We map the personal data you hold, from customers to staff to enquiries, and note why you hold it and how long you keep it. You see where you are exposed and where you are already fine.
About Scope & StrategySystems &
Solutions
We draft the records, privacy notice and retention schedule in plain English, set up a tidy way to handle requests, and fix sign up forms so consent and opt outs are captured and stored properly.
About Systems & SolutionsSecurity &
Support
We keep it current. When you add a tool, start a new kind of marketing or take on staff, we review what changes. NYAS is itself registered with the ICO and UK GDPR compliant.
About Security & SupportQuestions people ask
Does my small business need to register with the ICO?
Most organisations that handle personal data have to pay a data protection fee to the ICO unless an exemption applies, and the amount depends on size and turnover. The ICO website has a short self assessment tool. Use that or take advice rather than relying on us.
What is a lawful basis under UK GDPR?
It is your legal reason for using personal data. There are six: consent, contract, legal obligation, vital interests, public task and legitimate interests. Which one fits depends on what you do with the data. Read the ICO guide and take legal advice where it is unclear.
How long do I have to answer a subject access request?
Generally one month from receiving it, with limited scope to extend for complex requests. The real work is knowing where your data lives before one arrives. Check current ICO guidance, because exemptions and details matter and you may need advice.
Where do I start with UK GDPR for my business?
Start with a conversation. We will ask what personal data you collect, from whom and why, and tell you plainly which gaps look worth fixing first. We will also say where you should speak to a solicitor, because we do not give legal advice.
Talk to us about UK GDPR and data protection.
You tell us what is going on. We tell you honestly whether we can help, and if we cannot, we will say so.