Mention GDPR to most small trade businesses and you'll get a slightly nervous laugh and a change of subject. It sounds like corporate legal wallpaper - something for banks, not for a firm with five vans and a spreadsheet of customer addresses. Unfortunately, if you hold any personal data (and a customer list absolutely counts), it applies to you too.
The bit that actually matters for small firms
You don't need a Data Protection Officer or a forty-page policy document. The Information Commissioner's Office is fairly clear that proportionality is built into the rules - what's expected of a five-person firm is very different from what's expected of a bank. The core obligations boil down to: only keep data you actually need, keep it reasonably secure, and be able to delete or hand over someone's data if they ask.
Where trade businesses usually fall down
- Customer addresses and phone numbers sitting in a personal phone's contacts, with no backup and no way to delete just one entry
- Spreadsheets shared over email with no password, sitting in everyone's inbox forever
- No real answer to "what would we do if someone asked us to delete their data"
The fix is usually boring, which is good news
Proper data protection for a small firm is mostly about tidiness: one system for customer data instead of five, reasonable access controls, and a habit of not keeping information longer than you need it. This is, conveniently, also just good business practice - a tidy customer database is easier to work from as well as easier to defend. If you're building or rebuilding a customer system from scratch, it's worth designing data handling in from day one rather than bolting it on later; it's a much smaller job that way. See our take on custom CRM builds for how that tends to work in practice.
The verdict
GDPR isn't really aimed at small trade businesses, but it doesn't exempt them either. The good news is that doing it properly is mostly just doing things sensibly, with slightly better labelling.