General Data Protection Regulation (GDPR) FAQs for small retailers

If you are in the care home or the finance sector you may have received a letter from the us about your obligation to pay a data protection fee. If you have already paid your fee you do not need to take any action. If you need to pay or unsure if you do you can find further information here (external link).

You must not send marketing emails or texts to individuals without specific consent. There is a limited exception for your own previous customers, often called the ‘soft opt-in’.

This term is sometimes used to describe the rule about existing customers. If an individual bought something from you recently, gave you their details, and did not opt out of marketing messages, they are probably happy to receive marketing from you about similar products or services even if they haven’t specifically consented. However, you must have given them a clear chance to opt out – both when you first collected their details, and in every message you send.

Further guidance on electronic mail marketing (external link) and the ‘soft opt-in’ can be found on ICO website.

You must tell people if you set cookies, and clearly explain what the cookies do and why. You must also get the user’s consent. Consent must be actively and clearly given. There is an exception for cookies that are essential to provide an online service at someone’s request (eg to remember what’s in their online basket, or to ensure security in online banking). The same rules also apply if you use any other type of technology to store or gain access to information on someone’s device.

Further guidance can be found on ICO cookies and similar technologies page (external link).

If you are concerned about how the end of the transition period will impact you organisations data, we have a range of guidance and resources to help you prepare (external link).

Following our work with over 50 town and parish councils across the UK, ICO developed a suite of resources (external link) to help local councils with some of their key data protection issues.

Does the GDPR apply to business-to-business marketing? What counts as consent? These are just a couple of questions we get about business to business marketing under the new law. ICO document about the rules around B2B marketing (external link), the GDPR and PECR answer these and many more.