GDPR and data protection review

Most small businesses hold more personal data than they realise. Customer records in a CRM, staff files in a shared drive, enquiry forms feeding an inbox, a mailing list somebody exported to a spreadsheet three years ago and never deleted.

I go through what you actually hold, where it lives, who can see it, how long you keep it and what happens if it leaks. Then you get the practical version: a privacy notice that matches reality, a retention approach you will actually follow, and a straight answer on whether you need a DPO.

If a customer or a tender has asked about GDPR, or you have had a subject access request and are not sure what to do, this is the place to start.

Written so a business without a legal team can act on it.