What Company Formation Services Don’t Tell You About Data Protection Obligations From Day One

You’ve just received your certificate of incorporation from Companies House. The formation service sent a confirmation email, maybe a welcome pack, and a reminder to open a business bank account. What that email almost certainly didn’t mention is that you now have data protection obligations, and some of them may already be overdue.

Below is what those obligations are, when they start, and what a new limited company director needs to do before processing a single piece of personal data.

What Company Formation Services Leave Out

A company formation service does one thing well: it registers your company. It files the documents with Companies House, sets up your memorandum and articles of association, and gives you a registered address. That’s the product, and it’s delivered cleanly.

What it doesn’t do is tell you what happens next from a legal compliance perspective. The confirmation email doesn’t mention the Information Commissioner’s Office (ICO), the UK’s data protection regulator. It doesn’t mention UK GDPR. It doesn’t ask whether you’ve thought about a privacy notice.

That gap matters because personal data processing starts earlier than most new directors expect.

You saved a potential client’s email address while the company was still being formed. You put a supplier’s phone number in your contacts. You set up Google Analytics on a holding page before launch. You signed up for cloud accounting software and entered your own details. Each of these actions involves personal data. Each of them triggers data protection obligations under UK law.

One thing worth flagging: your registered address is published on the Companies House register and is visible to anyone. If you’ve used your home address, that’s your personal data sitting in a public database. Many new directors don’t realise this until after registration. Using a service address is a straightforward fix for future registrations.

UK GDPR and the Data Protection Act 2018: What They Are and Why They Apply

UK GDPR is the version of the EU’s General Data Protection Regulation that applies in the United Kingdom following Brexit. It was retained in UK law and sits alongside the Data Protection Act 2018, which fills in the gaps and gives the ICO its enforcement powers.

Personal data means any information that identifies or could identify a living individual. A name, an email address, a phone number, an IP address. All of it counts.

UK GDPR applies to any organisation that processes personal data. Processing means almost anything you do with data: collecting it, storing it, viewing it, sharing it, deleting it. There’s no turnover threshold. There’s no minimum employee count. A one-person limited company with its first client is subject to the same core principles as a company with five hundred staff.

The Seven Principles Under Article 5

Article 5 of UK GDPR sets out seven principles that apply to all personal data processing. Every new company needs to understand them because they shape every other obligation that follows.

• Lawfulness, fairness, and transparency: you must have a legal basis for processing, and you must be open about it.
• Purpose limitation: collect data for a specific reason and don’t use it for something else.
• Data minimisation: collect only what you actually need.
• Accuracy: keep personal data up to date.
• Storage limitation: don’t keep data longer than necessary.
• Integrity and confidentiality: keep data secure.
• Accountability: be able to demonstrate that you’re complying.

The accountability principle is the one that catches new companies out most often. It’s not enough to comply. You need to be able to show that you comply, which means keeping records.

ICO Registration: The Obligation Most New Companies Miss

The Information Commissioner’s Office is the UK’s independent data protection regulator. It enforces UK GDPR and the Data Protection Act 2018, handles complaints from individuals, and issues fines for serious breaches.

Most organisations that process personal data must pay an annual data protection fee to the ICO. This is separate from Companies House registration. The fee ranges from £40 for micro-organisations to £2,900 for large organisations, with most small limited companies falling into the £40 or £60 tier.

Failing to register when required is a criminal offence under the Data Protection Act 2018. The ICO can issue a fixed penalty notice. This isn’t a theoretical risk for small companies. The ICO has issued notices to sole traders and small businesses for non-payment of the fee.

Do You Need to Register? A Simple Check

The ICO’s own guidance walks through the self-assessment in detail. Check it before your company takes on its first client or sends its first marketing email.

Lawful Basis: The Question Every New Company Must Answer First

A lawful basis is the legal justification for processing personal data. Under Article 6 of UK GDPR, every act of processing must have one. There are six options.

• Consent: The individual has given clear, specific agreement. This is harder to rely on than most people assume, and it can be withdrawn at any time.
• Contract: Processing is necessary to perform a contract with the individual, or to take steps before entering one. This covers most client data for service businesses.
• Legal obligation: Processing is required by law. This covers payroll records, HMRC reporting, and similar obligations.
• Vital interests: Processing is necessary to protect someone’s life. Rarely relevant for most businesses.
• Public task: Applies to public authorities. Not relevant for most limited companies.
• Legitimate interests: Processing is necessary for your legitimate business interests, provided those interests aren’t overridden by the individual’s rights. This is the most flexible basis but requires a documented assessment.

Which Basis Applies to Your Common Data Types

For a typical contractor or freelancer operating through a limited company, the picture looks like this.

Client data you process to deliver a service: contract is usually the right basis. You need the client’s name, contact details, and relevant project information to perform the work. That’s straightforward.

Employee or payroll data: legal obligation covers most of it. You’re required by law to process payroll data for HMRC and National Insurance purposes.

Marketing emails to potential clients: legitimate interests may apply, but you need to document why your interests outweigh the individual’s right to privacy. Consent is an option but brings complications around how you collect and record it.

You must choose the lawful basis before you start collecting data, not after. And you must document the decision. That documentation is part of what the accountability principle under Article 5 requires.

Privacy Notices: What Your Company Must Tell People

A privacy notice tells individuals what personal data your company collects, why you collect it, what you do with it, how long you keep it, and what rights they have. Under Articles 13 and 14 of UK GDPR, you must provide this information at the point of data collection.

Articles 13 and 14 are specific about what a privacy notice must contain. A compliant notice includes:

• The identity and contact details of your company as the data controller
• The purposes and lawful basis for processing
• Any legitimate interests you’re relying on
• Who you share data with
• How long you keep data, or the criteria you use to decide
• The individual’s rights: access, erasure, rectification, restriction, portability, and objection
• The right to withdraw consent, if consent is your lawful basis
• The right to complain to the ICO
• Whether data will be transferred outside the UK, and what safeguards apply

A new limited company typically needs at least two privacy notices. One for clients and prospective clients, covering how you handle their contact details and project information. One for employees or contractors, covering payroll data, HR records, and any monitoring.

The notice must be live before you collect the first piece of data. If you have a contact form on a holding page, the privacy notice needs to be linked from that page before anyone fills it in.

Operating without a privacy notice when you’re collecting personal data puts you in breach of Articles 13 and 14 of UK GDPR. The ICO can investigate complaints from individuals and issue enforcement notices or fines. Getting a privacy notice in place before launch is far easier than dealing with a complaint after the fact.

Cloud Software, Payroll Tools, and Third-Party Services

Most new limited companies sign up for cloud accounting software, a payroll tool, and an email platform within the first few weeks of trading. Each of those sign-ups creates a data protection obligation that most formation services never mention.

The legal relationship works like this. Your company is the data controller: the organisation that decides why and how personal data is processed. The software provider is a data processor: an organisation that handles data on the controller’s instructions, following those instructions and no others.

Data Processing Agreements: What Article 28 Requires

Under Article 28 of UK GDPR, a data controller must have a written contract with every data processor it uses. This contract is called a data processing agreement (DPA). It must set out what the processor can do with the data, what security measures they must apply, and what happens if there’s a breach.

Many major software providers include a DPA in their terms of service or offer one on request. Check whether your accounting software, payroll provider, email platform, and CRM tool have a DPA in place. If they don’t offer one, that’s a problem worth taking seriously before you enter client data into their system.

This obligation applies from the first time you enter a client’s name into a cloud tool. It’s not something to sort out once the business is established.

Your Record of Processing Activities

A Record of Processing Activities (ROPA) is a documented inventory of all personal data processing your organisation carries out, required under Article 30 of UK GDPR. It lists what data you process, why, who has access to it, where it’s stored, and how long you keep it.

Article 30 includes an exemption for organisations with fewer than 250 employees, but that exemption has conditions. It doesn’t apply if your processing carries a risk to individuals’ rights, if you process special category data (such as health information), or if you process personal data regularly. Most trading limited companies process data regularly, so the exemption rarely applies in practice.

A ROPA doesn’t need to be complex. A spreadsheet with columns for data category, purpose, lawful basis, storage location, retention period, and third-party processors is enough to start. Starting one from day one is the easiest way to meet the accountability requirement under Article 5 and build the record that UK GDPR requires.

Data Subject Rights: What Clients and Employees Can Ask For

UK GDPR gives individuals a set of rights over their personal data. Your company must be able to respond to requests within one calendar month. The rights most relevant to a new limited company are:

• Right of access: An individual can ask for a copy of all personal data your company holds about them. This is called a data subject access request (DSAR). You must respond within one month, and you generally can’t charge a fee.
• Right to erasure: Sometimes called the right to be forgotten. An individual can ask you to delete their personal data in certain circumstances, such as when you no longer need it.
• Right to rectification: An individual can ask you to correct inaccurate personal data you hold about them.

You don’t need a dedicated compliance team to handle these. You need a simple process: know where your data is, know who’s responsible for responding to requests, and know the one-month deadline. Set that up before your first client is onboarded.

What Data Protection Obligations Apply to a New UK Company From Day One?

1. Register with the ICO and pay the annual data protection fee if required (most trading companies must).
2. Identify the lawful basis for each type of personal data you’ll process before you collect any of it.
3. Write and publish a privacy notice covering clients and, if applicable, employees.
4. Start a Record of Processing Activities listing what data you handle, why, and where it’s stored.
5. Check that every cloud tool or software provider you use has a data processing agreement in place.
6. Put a basic process in place for handling data subject access requests.
7. Appoint someone internally (even if that’s just you, as the sole director) to be responsible for data protection decisions.

Your Day-One Data Protection Checklist for a New Limited Company

Data protection compliance for a new limited company doesn’t require a lawyer or a dedicated compliance team. It requires a clear sequence of practical steps taken before the first client is onboarded. The steps below cover the minimum obligations under UK GDPR and the Data Protection Act 2018 for a typical small limited company.

None of these steps require specialist software or external consultants to get started. The ICO publishes free guidance written specifically for small businesses and sole traders. That guidance is the right starting point for each item on this list.

Frequently Asked Questions

Do I need to register with the ICO when I set up a limited company?

Most limited companies that process personal data do need to register with the ICO and pay the annual data protection fee. The fee starts at £40 for micro-organisations. Failing to register when required is a criminal offence under the Data Protection Act 2018, so it’s worth checking the ICO’s self-assessment tool as soon as your company is formed.

Does UK GDPR apply to a one-person limited company?

Yes. UK GDPR applies to any organisation that processes personal data, regardless of size or turnover. A sole director limited company with one client is subject to the same core obligations as a large employer. The obligations are the same; the complexity of implementing them is usually much lower for a small company.

What happens if I don’t have a privacy notice on my website?

Operating without a privacy notice when you’re collecting personal data, such as through a contact form or email sign-up, puts you in breach of Articles 13 and 14 of UK GDPR. The ICO can investigate complaints from individuals and issue enforcement notices or fines. For a new company, getting a privacy notice in place before launch is far easier than dealing with a complaint after the fact.

What is a lawful basis and do I need to choose one before I collect any data?

A lawful basis is the legal justification for processing personal data under Article 6 of UK GDPR. There are six options, and you must identify and document the appropriate one before you start collecting data. For most client data in a service business, the contract basis applies. For payroll data, legal obligation usually applies. Choosing the wrong basis, or having none at all, is one of the most common compliance failures for new companies.

What is a data processing agreement and when do I need one?

A data processing agreement (DPA) is a written contract between your company (as data controller) and a third-party service that handles personal data on your behalf (as data processor). Article 28 of UK GDPR requires one with every data processor you use. That includes your accounting software, payroll provider, email platform, and any other cloud tool that processes personal data for your business. Check for a DPA before you enter any client or employee data into a new tool.

Do I need a Record of Processing Activities from day one?

Article 30 of UK GDPR includes a partial exemption for organisations with fewer than 250 employees, but most trading limited companies still need a ROPA because they process personal data regularly. Start a simple spreadsheet listing what data you hold, why, and where. It’s the easiest way to meet the accountability requirement under Article 5 and build the record that UK GDPR requires.

Data protection obligations don’t wait for your business to grow. They attach from the moment your company handles its first piece of personal data. For a new limited company, the steps are manageable. Register with the ICO, pick your lawful bases, write a privacy notice, check your software agreements, and keep a record of what you process. Do those things before your first client interaction, and you’ll be starting from a position of compliance rather than catching up from behind.