GDPR Compliance Kit: answer a data request without the panic

It includes a data map, retention rules, a breach log, a processor list and two working flows on your site: one for people asking for their data and one for people asking to be deleted. The documents are written around your business, not a template with your name dropped in. The flows send a single-use confirmation link, log each request with its due date and tell you it has arrived. It is a one-off £349 and takes 5 working days.

Yes - UK GDPR applies to any business that handles personal data, whatever its size. If you keep customer names and emails, staff records or CCTV, you are covered. Most small firms also owe the ICO an annual data protection fee, which is a separate thing from this kit. Size changes how much paperwork is sensible, not whether the rules apply - which is why the kit stays small and practical.

You have one calendar month from the day you receive it, under the right of access. You can extend in limited cases, but you still have to reply inside the month to say so. The flow logs every request with its due date, so the deadline lives somewhere other than your memory. On GigXchange the confirmation email tells the person the date too, which cuts down the chasing.

Nothing is released until the person clicks a single-use link sent to the email address on your records. The link expires after 24 hours. The form gives the same reply whether or not the address is known to you, so nobody can use it to find out who your customers are. The export also leaves out other people's details - a counterparty appears by name only, never with their email or phone.

The request flow still works - it confirms the person, logs the request and starts the clock. The export is then gathered by you from a checklist we write, listing every place their data might be. A fully automatic export needs your data in a system we can query, such as a booking or shop platform. Ask before you buy and we tell you which applies, in writing.

You record it in the breach log, judge the risk to the people affected, and if it is likely to harm them you report it to the ICO within 72 hours of finding out. The log keeps every incident, including the ones you decide not to report, because you may have to show your reasoning later. For the wider "the site is down, the laptop is stolen" plans, see the Incident & Continuity Plan.

No - it is a working system and a set of records, built by someone who runs them on a live marketplace. It covers what a typical small business needs to meet its everyday duties. If you are facing a complaint, a dispute or an unusual kind of data, you need a solicitor, and the kit gives them a clear picture to start from, which usually makes their time cheaper.

This kit is about your duties to people: knowing what you hold, answering requests and keeping a breach log. A Database Security Audit is about the locks: making sure nobody can read records they should not. If your business runs on its own app or customer database, you probably want both. If your data lives in spreadsheets and an off-the-shelf tool, this kit alone is the sensible start.