0/3
Business Advisory Launch Programme · Stage 3 of 10
Protect Your Data & Confidentiality
Register, secure the sensitive data you hold, and paper the confidentiality that earns client trust.
How long
~half a day
You’ll have
ICO registered, data secured, and an NDA ready
Steps
3 steps
Resources
2 resources
-
01 Step 01
Step 01
Register with the ICO
Almost every UK business that processes personal data must pay the ICO’s data protection fee by law.
Do it yourself
- Use the ICO self-assessment to confirm you need to register (an adviser holding client data almost always does).
- Identify your tier: a solo adviser is nearly always Tier 1, at £52 a year (Tier 2 £78, Tier 3 £3,763).
- Pay online, taking the £5 discount for direct debit, and diarise the annual renewal.
- Confirm your own tier and obligation on ico.org.uk, because this station points, it does not decide.
Common mistake · Assuming a one-person company is exempt. Processing client personal data generally triggers the fee whatever your size.
Time~20–30 min Cost£52/yr Tier 1 (£47 by direct debit); confirm current on ico.org.uk DifficultyEasy -
02 Step 02
Step 02
Stand up basic data-protection practice
Registering is step one; you also have to handle the data lawfully.
Do it yourself
- Publish a simple privacy notice: what data, why, how long, and people’s rights.
- Set a retention rule, and return or delete client financials at the end of an engagement.
- Store everything in secure, access-controlled cloud storage with MFA, not email attachments.
- Know how you would handle a breach and a subject-access request, pointing to ICO guidance for the detail.
Common mistake · Treating data protection as a one-time registration, then emailing a client’s financials around with no security.
Time~2–3 hours CostFree DifficultyMediumResource for this step
CHECKLISTAdviser data-protection starter pack
The everyday hygiene that keeps sensitive client data safe and lawful.
-
03 Step 03
Step 03
Paper your confidentiality with a mutual NDA
Clients hand you their weak points, so visible confidentiality earns trust and protects you both.
Do it yourself
- Put a mutual, two-directional confidentiality clause into your standard engagement terms as the default.
- Keep a standalone mutual NDA ready for pre-engagement conversations where a prospect needs one first.
- Define what is confidential, the exclusions (already public, legally required), and a two to three year tail.
- Agree upfront whether you may describe the work anonymously as a case study later.
Common mistake · Using a one-directional NDA that only binds you, leaving your own methods and pricing exposed.
Time~1–2 hours Cost£0–£150 if a solicitor reviews it (rough) DifficultyMediumResource for this step
CHECKLISTMutual NDA and confidentiality clause
The parts a two-directional NDA needs. A template to adapt, not legal advice.
What you’ll have after this stage
- Your ICO data protection fee paid and renewal diarised
- A privacy notice and a retention rule
- Secure, access-controlled storage for client files
- A mutual NDA and confidentiality clause ready to use