GDPR and the Data Use and Access Act 2025 for Small Businesses: The Bits That Actually Apply to You

If you run a small UK business, you almost certainly hold personal data. Customer names, email addresses, a booking diary, a spreadsheet of leads, a list of who's owed an invoice. That alone puts you inside data protection law, and the acronyms around it (UK GDPR, the DPA 2018, PECR, and now the DUAA) make the whole thing sound like a job for a legal department you don't have.

Thankfully it's not that bad. The list of things a typical SME must do is short, and most of it is common sense written down. This piece walks through that list, then explains the one change in the new Data (Use and Access) Act 2025 that made life a little lighter, the cookie rule that changed on 5 February 2026. We run the LibraBit site's own analytics on that new basis, so this comes from doing it ourselves.

Before we start, this is general guidance and not legal advice. The basics below cover the common case, so if your business handles health data, children's data, or anything unusual, get a professional to look at your specifics.

First, the one bill most people forget: the ICO fee

This one catches a lot of people out. If you process personal data on a computer, you probably have to pay the Information Commissioner's Office an annual data protection fee, unless you qualify for a specific exemption. It's simply the registration fee that funds the regulator, and it applies to most businesses and many sole traders.

The fee comes in three tiers based on your size. The ICO sets it at £40 for micro organisations (turnover up to £632,000 or ten or fewer staff), £60 for small and medium organisations (turnover up to £36 million or 250 or fewer staff), and £2,900 for large organisations (ICO). Most independent shops, salons, agencies, and consultancies sit in that first £40 band.

It's worth sorting out early, because the ICO can fine you up to £4,350 for failing to pay when required (ICO). Paying £40 to avoid a four-figure fine is an easy decision, so check whether you're exempt, and if you're not, pay it.

Pick a lawful basis, and write a plain privacy notice

Under UK GDPR you can't just process personal data because it's handy. You need a lawful reason, and you have to pick it before you start. There are six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests (ICO).

For most everyday SME activity, two of those do almost all the work. "Contract" covers anything you need to do to deliver what a customer has bought, like taking a delivery address or sending a booking confirmation. "Legitimate interests" is the flexible one, used for things like basic record-keeping or fraud prevention, and it carries a three-part test: identify the purpose, check the processing is necessary for it, and balance it against the person's rights (ICO). Consent is for the things people should actively opt into, marketing emails being the obvious one.

The DUAA added a new option here too, a "recognised legitimate interests" basis where, for certain limited purposes set out in the Act, you don't have to run the balancing test (UK Parliament). It's a small relaxation, and the six bases above still describe how nearly all small-business processing works.

Once you've picked your basis, tell people. A privacy notice is just a plain-English page on your website that says what data you collect, why, what your lawful basis is, how long you keep it, and how someone can ask to see or delete it. It doesn't need legalese, and the ICO publishes free templates and step-by-step guides aimed specifically at small organisations, so you don't need to pay a lawyer to draft one (ICO).

Know what you hold, because someone will ask

You can't protect or hand over data you've forgotten you have, so the next job is a rough map of what personal data sits in your business, where it lives, and who can get at it. That means the booking system, the email inbox, the accounting software and the old spreadsheet on a laptop. The map also makes the next two jobs much easier to handle.

The first is the subject access request, or SAR. Anyone can ask for a copy of the personal data you hold about them, and you have to comply. You must respond without undue delay and within one month, extendable by a further two months if the request is complex or numerous, and in most cases you can't charge a fee (ICO). The information has to be provided in an accessible, concise format and sent securely.

A SAR doesn't have to arrive on headed paper or even use the word "SAR", so a customer emailing "send me everything you've got on me" counts, and the clock starts when you receive it. This is where the data map helps, because if you know where everything is, a SAR is an afternoon's work. If you don't, you'll be rushing to meet a legal deadline.

If something goes wrong, you have 72 hours (sometimes)

Breaches do happen, whether it's a laptop getting nicked, an email going to the wrong list or a database left open. When a personal data breach happens, you may have to report it to the ICO without undue delay and within 72 hours of becoming aware of it (ICO).

Not every breach is reportable, which is why it says "may". The duty only kicks in where the breach is likely to result in a risk to people's rights and freedoms (ICO). The ICO's own example of something you needn't report is a low-risk slip like an internal staff lunch spreadsheet being deleted. A leaked list of customer names, addresses, and card details is a very different matter, and you would need to report that one.

Two practical points make this less frightening. First, you don't need the full story in 72 hours, because if you can't gather everything in time, you can report in phases. Second, the 72 hours starts when you become aware of the breach, which may be later than when it happened, so it helps a lot to have someone who knows to escalate quickly. It's a good idea to decide in advance who rings the ICO, before you ever need to.

The DUAA cookie change: what actually moved on 5 February 2026

The cookie change is the part most people have heard about. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (legislation.gov.uk). The amendments that matter for cookies came into force on 5 February 2026 (Data Protection Network).

This is good news for small sites. Before this, you needed prior consent (the cookie banner click) for almost any non-essential cookie, including basic visitor analytics. The DUAA inserts a new Schedule A1 into PECR creating an exception, so certain low-risk first-party analytics can now run on a notice-and-objection basis instead. That means you tell people clearly and give them a simple way to opt out, instead of blocking the cookie until they opt in.

The exception is narrow, though, and it only applies if you meet all four conditions set out in the Act. Here they are, close to the exact statutory wording (legislation.gov.uk, Schedule 12):

1. the user is provided with clear and comprehensive information about the purpose of the storage or access;
2. the user is given a simple means of objecting, free of charge, and does not object;
3. the sole purpose is to collect information for statistical purposes about how the service is used, with a view to making improvements; and
4. any information collected is not shared with any other person except to help make those improvements.

All four have to be true at once, and the same Schedule A1 adds two more exceptions on the same opt-out basis: one for adapting how a site displays to a user's preferences, including accessibility (paragraph 6), and one for working out a user's location when they request emergency assistance (paragraph 7).

The LibraBit site runs on this basis. Our analytics are first-party, the data isn't sold or shared for any purpose other than improving the site, we publish a clear notice, and there's a simple free opt-out, so there's no consent wall when you arrive.

Where it stops, and where the stakes went up

Read those four conditions again and you'll see what's excluded. The test is about how your site is used, and it doesn't cover who is using it (ICO). The moment a cookie touches advertising, tracks or profiles individuals, or shares data with a third party for marketing, you're outside the exception and you still need full consent. Google Ads pixels, Meta tracking, anything that builds a profile to retarget people, none of that qualifies. If your analytics also feed an advertising platform, the whole lot needs consent.

So you still have some work to do, because you must give people a clear notice and a working opt-out, and you have to be honest with yourself about what your cookies actually do.

It's also worth knowing the stakes rose at the same time. The DUAA raised the maximum fine for PECR breaches, which cover cookies and electronic marketing, from £500,000 to the UK GDPR level of £17.5 million or 4% of global annual turnover, whichever is higher (Data Protection Network). No realistic small business is getting fined millions for a cookie banner, but it does show where things are heading. Getting consent wrong, or pretending advertising cookies are "just analytics", is a worse idea than it used to be.

A short checklist to get straight

You can do almost all of this yourself in a day or two using the ICO's free SME guides and self-assessment tools.

1. Pay the ICO data protection fee (or confirm you're exempt). Usually £40 for a micro business.
2. Pick a lawful basis for each thing you do with personal data. Contract and legitimate interests cover most of it, and consent covers marketing.
3. Publish a plain privacy notice on your site. Use an ICO template.
4. Map what you hold: data, where it lives, who can access it. This makes everything else much easier.
5. Have a SAR process: know you've got one month, know where the data is, respond securely.
6. Have a breach plan: who escalates, the 72-hour rule, and the judgement of whether it's actually reportable.
7. Sort your cookies honestly: first-party analytics can use the new notice-and-opt-out basis if you meet all four DUAA conditions. Anything advertising or third-party still needs consent.

What to take away

A lot of the worry around data protection comes from seeing it as one big scary thing. In practice it's a handful of separate jobs you can finish, and a sensible owner would do most of them anyway: know your customers' data, look after it, be straight about what you collect, and have a plan for when someone asks or something breaks.

The DUAA didn't make any of that harder, and on cookies it made one part lighter, as long as you stay honest about the difference between counting visits and tracking people. If your situation has real edge cases, that's when to bring in a professional. It's also the kind of practical, do-the-right-thing engineering we care about when we choose how to build software for clients. For everything else, the ICO's free guides and templates cover most of what you need.

References

• Data (Use and Access) Act 2025, full text, legislation.gov.uk (2025 c. 18, Royal Assent 19 June 2025)
• Data (Use and Access) Act 2025, Schedule 12, new PECR cookie exceptions, legislation.gov.uk (the four statutory conditions, verbatim)
• What are the exceptions? Guidance on the use of storage and access technologies, ICO
• Data protection fee, ICO (fee tiers and non-payment penalty)
• A guide to lawful basis, ICO (the six lawful bases)
• A guide to subject access, ICO (one-month SAR deadline)
• 72 hours: how to respond to a personal data breach, ICO (breach reporting, risk-based)
• Getting started with data protection, ICO (free SME guides and templates)
• Data (Use and Access) Act 2025 Bill page, UK Parliament (recognised legitimate interests)
• UK GDPR and PECR: key DUAA reforms take effect, Data Protection Network (5 February 2026 commencement, PECR fine increase)