UK GDPR document templates for small businesses. Written by a Data Protection Officer.
United Kingdom
- Tweets 22
- Following 120
- Followers 5
- Likes 110
Most agencies only think about a DPIA once the campaign's live.
It's meant to happen before higher-risk work starts: profiling at scale, tracking people across sites for ad targeting.
After launch, it's evidence the risk came late.
Before or after, for yours? #DataProtection
2
Most small recruitment agencies don't realise a subject access request doesn't need those exact words.
If a candidate emails asking what you hold on them, that's a SAR. The clock starts when it lands, not when someone notices.
Does your inbox catch it by day 20?
#DataProtection
4
I've seen charity intake forms where a dietary requirement or health condition sits in the same column as name and address.
Health data is special category under GDPR, needing its own lawful basis, not the one covering the rest.
Does yours treat it differently? #UKCharity
6
A laptop goes missing. An email goes to the wrong person.
The clock on telling the ICO starts immediately, not once it's fixed. 72 hours to decide and start containing, not to have it solved.
20 plain-English questions, no sign-up: certoa.co.uk/free-assessment
9
A funder or bigger client asks for "your GDPR policy." What exists is usually a vague sense one's needed, not a document.
It's the one that ties the rest together: what you do with people's data, and who's responsible.
20 plain-English questions: certoa.co.uk/free-assessment
4
Most small agencies I talk to don't think about a data processing agreement until a client's due diligence form lands, deadline attached. It always wants the same things: what data you hold, who processes it, how long you keep it. Worth having those answers ready first. #GDPR
6
Most small charities I talk to have a retention line that just says "as long as necessary". That's a placeholder, not a period. A funder or ICO check wants real timeframes for donor records, safeguarding notes, volunteer files. Does yours name one, or just the phrase? #UKCharity
5
Somebody fills in your contact form or joins your newsletter. UK GDPR expects you to have told them what happens to their data, not to explain it once they ask. A generic notice copied from a template site doesn't hold up, it has to describe what your business actually does.
10
Most small recruitment agencies I talk to have a privacy policy on the website. Almost none have one covering the CVs already sitting in their database.
Does yours say what's held, why, and for how long, or does it stop at the contact form?
#DataProtection
11
Working with GDPR since 2018, the deadline that catches small businesses out most is the one-month subject access request window. A customer or ex-employee can ask what data you hold on them, and the clock starts the day the request lands, ready or not. certoa.co.uk
5
Launching a CRM, CCTV, or an app? You might need a DPIA first. It is required when a project is likely to cause high risk: sensitive data at scale, public monitoring, automated decisions, or location tracking. Catch the problem before you build, not after. certoa.co.uk
4
Had a data breach? You have 72 hours to notify the ICO, but only if it is likely to put people at risk. Not every incident needs reporting. Knowing which do, and having a short response process ready, is what actually saves you on day one. certoa.co.uk
5
A subject access request gives you one calendar month to respond, not once you get round to it. Most businesses get caught out on the clock, not the substance, often when it lands on a Friday with no owner. Sort a process before you need one. certoa.co.uk/downloads
5
A subject access request gives someone one calendar month to see their data. Most businesses that get caught out aren't wrong on the substance, they're wrong on the clock. Have a short process ready before a request lands. certoa.co.uk
6
The Certoa template library is live at certoa.co.uk.
7 UK GDPR document templates, written the way I'd write them for a paying client as a certified DPO. From £29, or the full bundle for £149.
Not sure where to start? Free 2-minute assessment: certoa.co.uk/assessment
6