Protect Your Data

Do it yourself

• Run the ICO self-assessment to confirm you must pay. You will.
• Pay the data protection fee. A new solo consultancy is almost always Tier 1, currently £52 (ten or fewer staff, or turnover under £632k), with Tier 2 at £78 and Tier 3 at £3,763. The fee rose on 17 February 2025, so confirm the current figure on ico.org.uk.
• Diarise the annual renewal so your registration never lapses.
• Put your ICO registration reference where clients can see it, like your site footer or privacy notice.

Do it yourself

• List where special-category data enters your work: sickness and occupational-health records, disability adjustments, disciplinary and grievance files, investigation notes, and DBS or criminal-record data.
• Note that you and your client need an Article 6 lawful basis and an Article 9 condition, commonly the employment condition. In the UK many conditions require an appropriate policy document under Schedule 1 of the DPA 2018, so confirm which fit your processing with the ICO.
• Set a retention period per data type and a deletion routine, tied to why you hold the data and any statutory minimum.
• Apply data minimisation: collect only what the task needs.

Do it yourself

• Draft a privacy notice for your own business, covering staff, clients and prospects, and publish it on your website.
• Set your security basics: encrypted devices, MFA, strong passwords, access control, and secure storage for client files.
• Write a simple personal-data-breach process: what counts, how you would assess it, and the duty to report a reportable breach to the ICO within 72 hours.
• Know that a subject access request carries a one-month response duty, and follow the ICO’s guidance for handling one.

Do it yourself

• Understand the split: the client employer is the controller of its HR data, and when you process it strictly on their documented instructions you are likely a processor, needing an Article 28 written data-processing agreement.
• Understand the nuance: when you exercise independent professional judgement in the advice you give, you may be a controller in your own right, like a solicitor or accountant. Many HR consultants are a mix across engagements.
• Put a written data agreement in place with every client, covering security, sub-processing, breach reporting and audit.
• Confirm the status against the ICO’s controller and processor guidance rather than assuming it, because a mishandling by you can make both you and the client non-compliant.