Most small businesses need a short written record of the personal data they use regularly. Businesses with fewer than 250 staff only have to record processing that is not occasional, is likely to put people at risk, or involves sensitive ("special category") or criminal offence data. Handling customer details for every job is not occasional, so it usually needs recording. The record says who you are, why you use the data, whose data and what kind, who you share it with, how long you keep it and how you keep it safe. The ICO has a free template. You must also log every data breach, even ones you don't report.
Last updated 2 November 2026. Checked against the ICO's own pages on ico.org.uk.
Not legal advice. This is a plain-English summary of the ICO's own published guidance, checked on 2 November 2026. For advice about your situation, speak to a solicitor or call the ICO's helpline on 0303 123 1113.
DataSorted is not affiliated with the ICO. DataSorted is a waitlist and demand test only: no product is live and no payment is taken.
The ICO says most organisations must document their processing to some extent. If you have 250 or more employees, you must document everything. Under 250, you must document processing that:
Even where you don't have to, the ICO says it is good practice to keep a record anyway.
The record must be in writing. Paper or a spreadsheet is fine. The ICO says paper may be enough for very small organisations whose processing rarely changes.
| Why | Whose data | What data | Shared with | Kept for | Security |
|---|---|---|---|---|---|
| Quotes, jobs and invoices | Customers | Name, address, phone, email, job notes | Accountant; invoicing app | Your own chosen period, for example as long as you keep your accounts | Phone passcode, app two-step login |
| Paying a helper | Staff | Name, address, bank details, National Insurance number | Payroll provider; HMRC | Your own chosen period | Locked folder, password-protected laptop |
An illustration of the format, not a recommended retention period. Set your own periods and be ready to explain them.
The ICO says some of its guidance is under review after the Data (Use and Access) Act 2025.
Usually yes, for anything done regularly. With fewer than 250 staff you only have to record processing that is not occasional, is likely to put people at risk, or involves special category or criminal offence data. Using customer details for every job is not occasional.
Your name and contact details, why you use personal data, whose data and what types, who you share it with, any transfers outside the UK, and if possible how long you keep it and how you keep it secure.
Yes. It must be in writing, but paper or a spreadsheet is fine. The ICO says paper may be enough for very small organisations whose processing rarely changes, and it offers a free spreadsheet template.
Yes. You must record every personal data breach, including the facts, its effects and what you did, even if you don't need to report it to the ICO.
No. It is a plain-English summary of the ICO's guidance, checked on 2 November 2026. DataSorted is a waitlist test only and is not affiliated with the ICO.
Everything above is taken from these ICO pages, checked on 2 November 2026. If anything here differs from the ICO, the ICO is right.
DataSorted is a planned phone-friendly helper for UK tradespeople and small businesses. It is not built yet. If you'd like to hear if it launches, join the free waitlist. It is free, nothing is charged, and you can ask to be removed at any time. Everything on this page can also be done for free using the ICO's own tools.