nermio
Try it free

Privacy and the law

Customer data and UK GDPR: what you actually have to do

Which rules apply to an ordinary customer list, what you may and may not record, how long you can keep it, and what your customer can ask for.

About 8 minutes to read

Illustration: a customer record beside a shield with a lock

You're allowed to keep a customer list

Let's start with what most people want to hear: keeping records of your customers is permitted. UK GDPR doesn't prohibit processing personal data; it sets conditions on *how* you do it.

For an ordinary business relationship the lawful basis is usually straightforward. Either the processing is necessary for a contract you have with the person — or for steps they've asked you to take before entering into one, which covers sending a quote — or you have a legitimate interest in it. The ICO lists six lawful bases and is explicit that none of them is better or safer than the others; there's no hierarchy.

What that means in practice: you don't have to put a consent tick-box in front of a customer you're quoting. Consent is one basis out of six, and for ordinary customer records it's rarely the right one.

Record what you use, not what you might one day use

This is the principle that goes wrong most often in practice, and it's called data minimisation: you collect no more than you need for the purpose.

A name, a work email address, a phone number and what was agreed — you need those. A date of birth "in case we ever want to do something with birthdays" you don't. And notes about someone's health, religion or political views are special category data, with much stricter rules attached; they have no place in a sales system.

A practical test for a notes field: would you say it out loud if the customer were reading over your shoulder? They have the right to ask for a copy of what you hold, so that chance is real — see below.

Two retention rules, pointing opposite ways

Two words get used interchangeably here and the difference decides what you do.

HMRC sets a minimum. You have to keep your business records whether anyone asks or not — and how long depends on what kind of business you are. If you're self-employed, at least five years after the 31 January submission deadline of the relevant tax year. If you run a limited company, six years from the end of the company financial year the records relate to, and longer if a return went in late or a compliance check is open. You can't get out of that, not even if a customer asks you to.

UK GDPR sets a maximum. You keep personal data no longer than you need it for the purpose. There's no number in the legislation; you decide a period and explain why it's reasonable.

In practice that's two regimes side by side: your invoices and contracts stay for the HMRC period because they must, and your conversation notes about a prospect who never became a customer go sooner, because there's no longer a reason to hold them. There's a longer piece on doing that tidy-up.

What your customer can ask for

Four rights that genuinely come up in a small business:

  • Access. They can ask what data you hold about them — a subject access request. You have one month to respond, extendable by up to two more only where the request is complex or they've made several; and in almost all cases you can't charge a fee. "It's somewhere in my inbox" is not an answer that survives that deadline.
  • Rectification. If something's wrong, you correct it.
  • Erasure. Allowed, except where a retention obligation applies. So you can delete a customer record and keep the invoices.
  • Objecting to marketing. If they don't want mailings any more, you stop, and it has to be easy — one click, no login screen. This one is absolute: there's no balancing test and no exception.

When you need a processor contract

If you use someone else's software to hold customer data — a CRM, an email platform, an accounts package — that supplier is a *processor* and you are the *controller*. Whenever a controller uses a processor there must be a written contract, and it isn't optional.

The ICO sets out what has to be in it: the subject matter and duration of the processing, its nature and purpose, the type of personal data and categories of people involved, and your obligations and rights as controller. Plus specific terms — the processor acts only on your documented instructions, keeps the data confidential and secure, only brings in a sub-processor with your prior authorisation and under a written contract, helps you answer individuals' requests, and deletes or returns the data at the end.

A decent supplier has that ready and doesn't need to negotiate it. If you have to ask for it and the answer is vague, that's a signal in itself.

What you can do today

You don't have to make a project of this. Three things remove most of the risk:

  1. Go through your notes fields and take out what you don't use. Especially old notes that have become personal.
  2. Write down how long you keep what, and why. Two paragraphs is enough; the point is that you can explain a period — and that you've checked the HMRC minimum for your own legal form.
  3. Make sure you can delete a customer record without the invoices going with it, and that you can find everything about one person inside a month. If your system can't do either, that's a real problem, not a theoretical one.

A warning about pieces like this one

This is an explanation, not legal advice, and it's written by a software supplier — we have an interest in you not finding this complicated. If you're dealing with sensitive data, large volumes, or something you're genuinely unsure about, look at the ICO's own guidance for small organisations or ask a solicitor.

The ICO publishes self-serve tools and short guidance aimed specifically at small businesses, sole traders and clubs, and it's written to be read rather than cited. That's an unusually good starting point for a regulator, and it's free.

Sources