Who is responsible for data protection in a small firm?

Key takeaways

The business itself is responsible for data protection, as the controller of the personal data it holds. In practice that means the owner or directors. Most small businesses do not need a formal data protection officer, but every business needs a named person who looks after it. When nobody does, the cost is hidden until something goes wrong.

• The business is the controller and is legally responsible.
• Most small firms do not need a formal data protection officer.
• Every firm needs 1 named person who owns data protection.
• Most organisations handling personal data must pay the ICO a data protection fee.

Who is legally responsible?

Under UK GDPR the controller is responsible: the organisation that decides why and how personal data is used. The Information Commissioner's Office explains that controllers carry the main obligations, including when they use processors such as software providers or outsourced teams. Responsibility cannot be delegated away.

• The hidden costs of doing everything in-house
• GDPR and offshore outsourcing

Does a small business need a data protection officer?

Usually not. A formal data protection officer is required only in certain cases, such as public authorities and organisations whose core activities involve large-scale monitoring or large-scale processing of special category data. The ICO still expects every organisation to have enough knowledge and resource to comply.

What goes wrong when nobody owns it?

When nobody owns data protection, the basics are missed. Each is small, and together they create real exposure.

• The ICO data protection fee is not paid.
• Privacy information is out of date.
• Old customer data is never deleted.
• Requests from individuals are not recognised or answered in time.
• A breach is not spotted, recorded or reported.
• Suppliers handle data without a written agreement.

• Shadow IT in a small business: risks and fixes
• Running a business on spreadsheets: when it breaks

How do you assign responsibility?

Assign a named lead, give them a short list and an hour a month. The ICO publishes advice for small organisations that covers the essentials.

• Name the lead and tell the team.
• List the personal data you hold and where.
• Check the fee, privacy notice and retention periods.
• Write down what to do with a request or a breach.
• Check contracts with anyone who processes data for you.
• Review once a year.

• Data security with an outsourced team

When should you get outside help?

Get outside help if you handle special category data such as health information, process data at scale, transfer it overseas or have had a breach. A few hours of specialist advice costs less than getting those wrong.

What does the role take in time?

For a typical small business, looking after data protection takes a day or two to set up and about an hour a month to maintain. Setup covers mapping what personal data you hold, checking the ICO fee, updating the privacy notice and writing short procedures for requests and breaches. The monthly hour is for reviewing new tools and suppliers, checking that old data is being deleted and answering staff questions.

Who is the right person?

The right person is organised, has some authority and sees how data moves through the business. In most small firms that is the operations manager, office manager or a director. It should not be the newest or most junior member of staff, and it should not be left to an outside supplier, because the responsibility remains yours.

• Senior enough to change how things are done.
• Close enough to operations to know where data goes.
• Given time in their role, not asked to fit it in.
• Supported with access to advice when needed.

How does this work when a provider handles your data?

When a provider handles personal data for you, they act as your processor and you remain the controller. The ICO expects a written contract setting out what they may do, how they keep data secure and what happens at the end. You should also know where the data is processed. A provider who cannot answer those questions clearly is a risk, wherever they are based.

What does this look like in practice?

A pattern we see: a former customer emails asking for a copy of their data. The message sits in a shared inbox for six weeks because nobody recognises it as a formal request with a legal time limit.

• See client work
• BPO Solutions for UK businesses

Data protection ownership checklist

Work through this in an afternoon.

• Name a data protection lead.
• Confirm the ICO fee position.
• Map what personal data you hold.
• Publish an accurate privacy notice.
• Set retention periods.
• Brief staff on requests and breaches.

• The hidden cost audit: score your business in an hour

Next step

Tell us how customer data moves through your business. We will show how we handle it securely for clients and where a named owner makes the difference, in a 30-minute call.