Many London SMEs hold personal data they rarely review: customer records in a CRM, payroll files in a cloud drive, and supplier contacts in a shared mailbox. Under the UK GDPR and the Data Protection Act 2018, the business remains accountable for that data even when an external firm runs its IT. Effective GDPR IT compliance in London therefore depends less on a single certificate and more on daily technical controls that the IT provider operates, records and reviews. This article sets out those controls and explains how owners can confirm that their provider delivers them.
Table of Contents
- Quick Takeaways
- Where Your Responsibilities Begin
- Access Control and Identity Management
- Backup, Recovery and Data Availability
- Choosing How GDPR Support Is Delivered
- Breach Response and ICO Reporting
- Records, Policies and Supplier Checks
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| The business stays accountable | As controller, the business remains responsible for personal data, so the service agreement with the IT provider should state who performs each control. |
| Access should follow a leaver procedure | Closing a former employee’s accounts on their last working day removes a frequent gap in Microsoft 365 environments. |
| Test restores, not only backups | A backup that has never been restored is unproven. Request dated restore test records at each review. |
| Plan around the 72-hour window | Certain breaches must be reported to the ICO within 72 hours of awareness, so the escalation route must be written down before an incident occurs. |
| Maintain a data map | A record of where personal data sits, including cloud applications and shared drives, is the starting point for every other control. |
| Review supplier terms when services change | Suppliers that process personal data need written terms covering security, sub-processors and deletion, and these should be checked whenever a tool is added. |
Where Your Responsibilities Begin
UK GDPR places the primary duties on the controller, meaning the organisation that decides why and how personal data is processed. An IT provider that hosts, administers or backs up that data usually acts as a processor. The distinction matters because a controller cannot transfer accountability to a supplier, however capable that supplier may be.
The ICO provides a self-assessment checklist designed for small business owners and sole traders. It asks owners to review how personal data is collected, stored and shared. That review should precede technical work, because firewall settings and software updates cannot be configured correctly until the business knows what data it holds.
In practice, a London business should expect its provider to answer three questions in writing: where personal data is stored, who can access it, and how it would be restored after an incident. Verbal assurances do not provide a documented position that can be reviewed later.
Access Control and Identity Management
Access control is a common origin of data incidents in small firms, whether through a reused password, a shared login or a former employee who still holds an active account. The provider should treat identity as the primary control rather than a configuration detail. Decisions about who should have access remain with the business, while configuration and monitoring are the provider’s responsibility.
Multi-factor authentication for every account
The provider should enforce multi-factor authentication across all accounts, not leave it optional for individual users. For Microsoft 365 tenants, this is typically applied through conditional access policies. Administrative accounts should be separate from everyday accounts and reviewed on a fixed schedule.
Pro tip: Ask your provider for a quarterly list of accounts that have not signed in for 90 days, and have a named director confirm which accounts should be closed.
Joiner and leaver procedures
New starters should receive access based on their role, and access should be removed on the last working day of each leaver. A written procedure with a named owner makes this process auditable. Without one, unused licences and shared mailboxes accumulate over time, and each one is a route to personal data that nobody is monitoring.
Backup, Recovery and Data Availability
Article 32 of the UK GDPR requires appropriate technical measures to protect personal data, including its ongoing availability and resilience. Loss of access to customer or staff records is therefore a compliance matter as well as an operational one. A backup is only meaningful when files can be restored within a time frame the business has agreed in writing.
Restore testing with dated records
A backup job reporting success does not prove that files can be recovered. The provider should carry out restore testing on a fixed schedule and record the results, including which systems were tested and how long recovery took. Failures should be reported in plain language, with a date for remediation.
Device encryption and management
Laptops and mobile devices that hold personal data should use full-disk encryption and remote wipe, and they should be enrolled in device management so that policy can be enforced centrally. Lost or stolen devices are a common route to data exposure in small firms. Encryption reduces the likelihood that a lost device becomes a reportable breach.
Choosing How GDPR Support Is Delivered
Most small businesses choose between three models for GDPR support. Each covers different parts of the work, and the gaps between them are where problems tend to appear. The table below compares the three approaches.
| Approach | What It Covers Well | Typical Gap |
|---|---|---|
| Part-time or in-house IT lead | Detailed knowledge of the business and fast decisions on site | Limited cover outside working hours, and little time for documented testing |
| Managed IT provider (outsourced IT department) | Monitoring, patching, access reviews, restore testing and written reporting under a service agreement | Policy decisions still rest with the business and must be stated in the contract |
| Standalone legal or data protection consultancy | Policies, privacy notices, data protection impact assessments and advice on lawful bases | Written policies may not be matched by controls in the live environment |
In practice, the most reliable arrangement combines policy input from a legal adviser with technical execution by a managed provider. iTO.London operates as an outsourced IT department for London SMEs, so the GDPR-related controls described in this article are delivered as part of a measurable service. Owners should ask whether each control can be traced to a written policy, and whether the provider can show the evidence.
Breach Response and ICO Reporting
UK GDPR requires controllers to report certain personal data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of them. That period runs from awareness, not from the completion of an investigation. A provider that takes two days to confirm whether an incident involves personal data has already used much of the window.
An effective arrangement defines what counts as an incident, who is notified, and who takes the reporting decision. The provider should monitor for suspicious sign-ins, endpoint alerts and unusual data transfers, and escalate to a named business contact on the same day.
Writing down the escalation route
The escalation route should name at least two business contacts, list out-of-hours numbers, and state which evidence the provider will preserve. A short tabletop exercise once a year shows whether the document works in practice. Gaps found during an exercise are far less costly to resolve than gaps found during a live incident.
Records, Policies and Supplier Checks
The accountability principle requires the business to demonstrate compliance, which means keeping records as well as applying controls. Records of processing, access reviews, restore tests and incident logs form the evidence base. When the ICO or a client asks questions, documentation allows a business to respond quickly and accurately.
Many small firms rely on cloud suppliers that process personal data on their behalf. Contracts with those suppliers should cover security measures, sub-processors and deletion at the end of the service. The provider should flag each new tool that stores personal data, so that the contract and the data map are updated together.
Maintaining an evidence pack
An evidence pack is a folder, reviewed quarterly, containing the data map, current policies, the latest restore test results and the most recent access review. Keeping it current requires far less effort than rebuilding it under pressure. Owners should receive a summary each quarter and sign off on any exceptions.
Compliance records are only useful when they are current. A policy that describes systems the business no longer runs creates risk rather than reducing it.
Pro tip: Ask your provider to add each new cloud application to the data map on the day it is approved, so that the record never falls behind the live environment.
Frequently Asked Questions
Does UK GDPR apply to a small business with only a few employees?
Yes. UK GDPR applies to any organisation that processes personal data, regardless of size. Staff records, customer details and supplier contacts all fall within scope, so the ICO self-assessment is a practical starting point for small teams.
Is my IT provider responsible for GDPR compliance?
The business remains the controller and carries overall responsibility. A provider acting as a processor has its own direct obligations under UK GDPR, but the business must choose a suitable provider and set the scope of the work in writing.
What should a GDPR section in an IT service agreement include?
It should describe the security measures in place, the frequency of access reviews and restore tests, the timeline for notifying the business of a breach, where data is stored, which sub-processors are used, and how data is deleted when the contract ends.
How quickly must a personal data breach be reported to the ICO?
Certain breaches must be reported without undue delay and, where feasible, within 72 hours of becoming aware of them. Not every incident is reportable, so the provider should help the business assess the risk to individuals before a decision is made.
Does every London SME need a Data Protection Officer?
No. Appointing a Data Protection Officer is mandatory only in specific circumstances, such as core activities involving large-scale monitoring of individuals or large-scale processing of special category data. The ICO guidance should be checked against the business’s own activities.
We welcome feedback from London business owners on how their current IT provider handles GDPR responsibilities, so please share your experience or the questions you would like addressed in future guidance.
We would love your feedback and any insights you would share with others. What perspective would you add?