GDPR for a one-person trade business: the plain-English basics

Yes, GDPR applies to a one-person trade business. If you keep customers' names, phone numbers and addresses, which every trade does, you are a data controller under UK GDPR, with basic duties: only collect what you need, keep it secure, keep it no longer than necessary, and be able to tell people what you hold. Most sole traders who store customer details on a phone or computer must also pay the ICO data protection fee, which is £40 a year for organisations with 10 or fewer employees. It sounds daunting; for a small trade it is mostly common sense plus a small annual fee.

A lot of sole traders assume GDPR is a big-company thing. It is not. If you hold customer information, it applies to you, but the basics are manageable. Here is the plain version.

Does GDPR apply to me?

If you keep any personal details about your customers, their name, number, address, what work you did, then yes. Deciding why and how that information is used makes you a "data controller," and UK GDPR sets out some basic duties. It does not mean you need a compliance department; it means handling people's details sensibly.

The basics, in plain terms

Only collect what you need. You need a name, number and address to do the job; you do not need anything you will not use.

Keep it secure. A password on the phone or laptop where the details live, and do not leave lists lying around.

Do not keep it forever. Hold customer records for as long as you genuinely need them (tax, warranties, repeat work), then clear them out.

Be able to say what you hold. If a customer asks what information you have about them, you should be able to tell them.

The ICO fee most sole traders owe

Here is the part people miss. As well as GDPR duties, most businesses that process personal data on a computer must pay the ICO's annual data protection fee. For organisations with 10 or fewer employees it is £40 a year, and not paying can lead to a fine. Whether you specifically need to pay has a quick official check, covered in do I need to register with the ICO as a sole trader.

If you use a vendor (like an AI receptionist)

If you use a service that handles your customers' data for you, they become your "processor" and you stay the controller. Ask them where the data lives, how long it is kept, and whether they will give you a proper agreement. The detail is in what happens to your customers' data when an AI answers your phone.

Frequently asked questions

Yes, if you keep customer details. You are a data controller with basic duties around collecting, securing and not over-keeping personal data.

Most sole traders processing personal data on a computer do; it is £40 a year for organisations with 10 or fewer employees. Check your position with the ICO's own tool.

Mostly it is common sense (collect less, keep it safe, do not hoard it) plus the small annual ICO fee.

Sources: ICO: data protection fee. Check your own position on the ICO website.

---