Keeping information safe in a digital world is no longer optional for UK business owners. If you run a small business, store customer records, process payments or use cloud software, you are responsible for protecting that data from theft, loss and misuse. The consequences of getting it wrong now go far beyond embarrassment: regulatory fines, legal claims and lasting reputational damage can all follow a single breach.
According to the UK government’s Cyber Security Breaches Survey 2024, half of all UK businesses identified at least one cyber security breach or attack in the previous 12 months. Among medium businesses the figure rose to 70%, and among large businesses it reached 74%. For women-led businesses operating with tight margins and small teams, the cost of recovery can be especially hard to absorb. See our Women in Business: Key UK Facts page for the latest statistics on women founders in the UK. This guide sets out what the law expects and what you can do this week to reduce your risk.
Why keeping information safe in a digital world matters to your business
The same Cyber Security Breaches Survey found that the average cost of a breach was £1,205 for micro and small businesses, £10,830 for medium businesses and £16,660 for large businesses in 2024. These figures cover direct costs such as IT support, legal advice and lost productivity. They do not include the longer-term damage of lost customers or the administrative burden of dealing with the Information Commissioner’s Office.
Despite this, only 31% of UK businesses have a cyber insurance policy in place. If you are among the uninsured, a breach could force you to cover legal claims, regulatory fines and recovery costs from your own cash flow.
Understand your legal duties under UK GDPR
UK GDPR and the Data Protection Act 2018 set the rules for how businesses collect, store and use personal data. The law applies to any business that processes information about identifiable living individuals, including customers, employees and suppliers.
The Information Commissioner’s Office can fine organisations up to £17.5 million or 4% of total global annual turnover, whichever is higher, for the most serious breaches. Even smaller mistakes can lead to enforcement notices, mandatory audits and public reprimands.
The core principles are straightforward: collect only what you need, keep it accurate, store it securely, do not keep it longer than necessary, and be transparent about how you use it. Your privacy notice should tell people what you collect, why you need it, how long you keep it and who you share it with.
Secure your devices, networks and accounts
Most attacks still succeed because of basic weaknesses. Start with these practical steps.
Use multi-factor authentication everywhere
Passwords alone are no longer enough. Require multi-factor authentication on email, banking, cloud storage, accounting software and any system that holds customer data. This single step blocks the vast majority of automated attacks.
Encrypt laptops, phones and portable drives
Encryption turns your data into unreadable code if a device is lost or stolen. Modern operating systems include free encryption tools: BitLocker for Windows and FileVault for Mac. Turn them on for every laptop and phone that holds business information.
Keep all your business software updated
Apply security patches as soon as they are released. Outdated software is one of the most common ways attackers break into small business systems. Where possible, enable automatic updates.
Control who can access your data
Not every employee needs access to everything. Apply the principle of least privilege: give people access only to the data and systems they need for their role. When someone leaves, revoke their access on the same day.
Be cautious with USB drives and portable storage. If you must transfer sensitive data physically, use encrypted drives and keep a record of what leaves your premises. For more guidance on protecting your workspace, see our article on Home Business Security: Essential Measures for UK Owners.
Prepare for the worst with an incident response plan
No system is perfect. What matters is how quickly you respond. Your incident response plan should include:
- Who takes charge when a breach is discovered
- How to contain the breach and preserve evidence
- Which customers, regulators and insurers to notify
- How to report to the ICO within 72 hours if personal data is involved
Under UK GDPR, you must report a personal data breach to the ICO within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. If the breach poses a high risk to the people affected, you must also tell them directly. You can report a breach through the ICO’s online self-assessment tool.
Consider Cyber Essentials certification
The National Cyber Security Centre’s Cyber Essentials scheme is a government-backed certification that helps businesses guard against the most common cyber threats. It covers five controls: firewalls, secure configuration, user access control, malware protection and patch management.
Certification is not mandatory for most businesses, but it is increasingly expected by larger corporate clients and public-sector buyers. It also gives you a clear checklist to work through and can reduce your cyber insurance premiums.
Build a security-aware team
Human error causes a large share of breaches. Train your staff to recognise phishing emails, suspicious links and unusual requests for passwords or payment details. Make it easy for them to report concerns without fear of blame.
Run regular backups and test that you can restore from them. Store at least one backup offline or in a separate cloud account so ransomware cannot reach it. For more on securing remote and hybrid working, read our guide on How to Secure Your Remote Work Environment in 2026.
Start protecting your business data today
Keeping information safe in a digital world is an ongoing responsibility, not a one-off task. The UK government’s Cyber Security Breaches Survey 2024 shows that half of UK businesses face attacks each year, yet simple measures such as multi-factor authentication, encryption and staff training stop most common threats. Start with a quick audit this week: list what data you hold, where it is stored and who can access it. Then fix the weakest link first.
Your weekly action plan for data security
- Audit your data: identify what personal information you hold and where it is stored.
- Enable multi-factor authentication on all business accounts.
- Encrypt laptops, phones and portable drives.
- Review and update your privacy notice.
- Prepare a one-page incident response plan with the ICO’s 72-hour reporting requirement in mind.
- Consider applying for NCSC Cyber Essentials certification.
