Does GDPR apply to me if I have fewer than 10 employees?

Yes, the core GDPR principles apply regardless of employee count. The only concession for very small businesses is a partial exemption from Article 30 record-keeping requirements, which applies only to organisations with under 250 employees in limited circumstances. Most SMEs that process customer data routinely will not qualify for this exemption. The ICO provides a self-assessment tool to check your specific position.

Do I need a Data Protection Officer?

Most SMEs do not. A DPO is a statutory requirement only if your core activities involve large-scale processing of special category data, large-scale systematic monitoring of individuals, or if you are a public authority. Having a nominated internal contact who manages data protection queries and keeps compliance documentation up to date is good practice and sufficient for most small businesses.

What is the fine for a small business GDPR breach?

Under UK GDPR, fines can reach up to £17.5 million or 4% of global annual turnover, whichever is higher. In practice, the ICO's published approach for small businesses focuses on achieving compliance through guidance and remedial action before escalating to financial penalties. Serious, repeated, or wilful non-compliance does lead to fines. For most SMEs, the greater immediate risk from a breach is reputational rather than financial.

Can I use US-based software like Mailchimp or Google Analytics?

Yes, with the correct safeguards in place. Following the UK-US Data Bridge (for UK data transfers) and the EU-US Data Privacy Framework (for EU data transfers), US companies that have certified under these frameworks can receive personal data from UK and EU businesses lawfully. Check that the specific tool you use has been certified under the relevant framework and has a Data Processing Agreement available.

How long can I keep customer data?

UK GDPR does not set fixed retention periods. The storage limitation principle requires that data be kept no longer than necessary for the purpose it was collected. In practice, this means setting your own retention schedule based on business need, legal obligations (such as tax records), and the reasonable expectations of your customers. A simple retention policy covering your main data categories is sufficient for most SMEs.

Is it GDPR-compliant to use ChatGPT with customer data?

Only with the right safeguards. If you use OpenAI's enterprise or API products with a signed Data Processing Agreement and have configured your account to opt out of training data use, processing customer data through these tools can be brought within a compliant framework. Free consumer accounts do not include a DPA and should not be used to process personal data belonging to customers or employees.

What does UK GDPR compliance look like for a Northern Ireland business trading with both the UK and ROI?

Northern Ireland businesses processing data from customers in both the UK and the Republic of Ireland are subject to UK GDPR for UK-resident data and EU GDPR for ROI-resident data. Under the Windsor Framework, NI maintains a degree of EU alignment in certain regulatory areas, which creates a dual-regime compliance consideration that most generic GDPR guides do not address. Seeking specific advice from a data protection professional familiar with the NI/ROI cross-border context is worthwhile if your customer base straddles both jurisdictions.

EU Digital Regulations for UK SMEs: GDPR, DSA and AI Act

Content Writing & Marketing

Writing White Papers & E-Books: B2B Authority Guide

Ciaran Connolly | 1st May 2026

Most B2B content competes for the same ground: blog posts, social updates, and opinion pieces that are easy to produce and just as easy to ignore. Writing white papers and...

Read Article

Integrating FinTech & Online Marketing Engagement & ROI

Digital Marketing Trends & Insight

FinTech Solutions and Online Marketing: A Guide for SMEs

Ciaran Connolly | 1st May 2026

FinTech solutions have changed what small and medium-sized businesses can do with their finances, from real-time payments and digital lending to automated accounting and open banking integrations. The harder challenge...

Read Article

Content Writing & Marketing

Storytelling in Content Marketing: A Strategic Guide for UK Brands

Ciaran Connolly | 1st May 2026

Most business content gets ignored. Not because the topic is wrong or the writer is untalented, but because the content is built around information alone, without any of the narrative...

Read Article

Digital Marketing Trends & Insight

Email Marketing for Non-Profits: Strategies That Actually Work

Ciaran Connolly | 1st May 2026

Email marketing for non-profits consistently outperforms other digital channels on return per pound spent, but most charities treat it as an afterthought. A campaign email goes out when there's a...

Read Article

SEO - Search Engine Optimisation

SEO for Non-Profit Organisations: A Practical Guide

Ciaran Connolly | 1st May 2026

SEO for non-profit organisations follows the same technical principles as commercial SEO, but the goals and content angles are different. Where a business wants to convert visitors into customers, a...

Read Article