GDPR for tradespeople: customer data, photos and records

What customer data a trade business holds

Trade businesses hold several categories of customer personal data in the course of everyday work. These include customer names, addresses and phone numbers. They also include photos, such as images of completed work, site conditions or property features. Access details form a further category, including key safe codes and access notes that allow a tradesperson to enter a property or reach a work area. Job records can link these details to a specific customer, address and visit. The data can be held on paper, on a phone, in a vehicle, in email or in software used to manage jobs. Customer names, addresses and phone numbers identify people directly. Photos can identify people or reveal information about a property. Access details can create a security risk if they are lost or seen by someone without authority. Key safe codes and access notes therefore need extra care. The same care applies to any record that combines a customer's identity with access information or photographs. A trade business may hold this data for a short period, such as while a job is open, or for longer if records are kept for accounting, warranty or dispute purposes.

UK GDPR applies to this customer data because it relates to identifiable people. A lost phone with unprotected job records is an example of a personal data breach. If a breach is likely to risk people's rights, it is required to be reported to the ICO within 72 hours of the business becoming aware of it. A subject access request from a customer requires a response within one month. These obligations apply alongside the ordinary handling of customer names, addresses, phone numbers, photos and access details. The business needs a record of what data it holds and where it is kept. Software providers usually act as processors, with a contract required. That contract sits alongside the trade business's own handling of customer data. Key safe codes and access notes need extra care because unauthorised access can affect a customer's property. Photos also need care because they can show a property or a person. The business can review who has access to job records, how long records are kept and how access details are stored. This review can cover paper records, phones and software used for job management.

Lawful basis and privacy notices

A trade business needs a lawful basis for processing customer personal data. Contract is a lawful basis where processing is necessary to provide a service that the customer has asked for. This can cover names, addresses, phone numbers and access details used to arrange and carry out a job. Legitimate interests is another lawful basis. It can apply where the business has a legitimate reason for processing and the customer's rights do not override that reason. A simple privacy notice can explain the lawful basis in plain language. It can also state what data is collected, why it is collected and how long it is kept. The notice can refer to customer names, addresses, phone numbers, photos and access details. It can explain that key safe codes and access notes need extra care. The notice can be provided at the point data is collected, such as when a job is booked. Software providers usually act as processors, with a contract required. The privacy notice can mention that software is used to manage customer data. A simple notice can cover the main categories of data and the reasons for holding them.

Personal data breaches can arise from lost devices, misdirected messages or exposed records. If a breach is likely to risk people's rights, it is required to be reported to the ICO within 72 hours of becoming aware. A subject access request requires a response within one month. Most businesses processing personal data pay an annual ICO data protection fee. The privacy notice can give a contact point for data questions. It can also explain how a customer can make a subject access request. The business can keep the notice under review when services, software or record keeping change. A contract with a software provider as processor can set out how customer data is handled. Key safe codes and access notes need extra care in any notice or record. Photos can also be covered by the notice where they form part of job records. Clear internal handling supports the statements made in the notice. The notice can be kept in a form that customers can read and retain. A simple notice can avoid unnecessary detail while covering the required information in a clear form.

Breaches and the 72-hour rule

Tradespeople routinely hold customer names, addresses, phone numbers, photographs and access details. This information is personal data and falls within UK GDPR. A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. A lost phone containing unprotected job records is a common example. Not every incident is reportable. A breach must be reported to the ICO within 72 hours of the business becoming aware of it where it is likely to result in a risk to people's rights and freedoms. The assessment is factual: what data was involved, who could access it, and what harm could follow. A lost device with no access protection and identifiable customer records is more likely to meet the threshold than a device that was remotely wiped before any access. The business must act promptly once awareness arises. The 72-hour clock is not paused while an internal investigation is completed. The threshold is risk, not certainty of harm, and it is assessed on the facts known at the time of awareness.

Reporting is made to the ICO. The report describes the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. If full details are not available within 72 hours, the business can make an initial report and provide further information in phases. The ICO states that delay in reporting is a factor it considers. A lost phone requires immediate containment where possible: remote wipe, password changes, and checks on whether access codes or key-safe details were stored. If the phone held photographs of customer properties, those images are personal data when linked to an identifiable person. The business must tell affected customers without undue delay where the breach is likely to result in a high risk to their rights. Records of all breaches, including those not reported, support accountability. The 72-hour rule applies from awareness, not from the end of the investigation. The report does not remove the need to contain the incident. A phone lost on site may also contain photographs of customer properties, key-safe codes and alarm details, all of which affect the assessment.

Seven basics

The seven data protection principles are a practical checklist for tradespeople. The first is lawfulness, fairness and transparency. A business needs a lawful basis for processing customer data and must tell people what it holds and why. The second is purpose limitation: data collected for a repair or installation is not freely available for unrelated marketing. The third is data minimisation. Only the data needed for the job is collected, such as a phone number for access and an address for the work. The fourth is accuracy. Customer records and photographs must be correct and kept up to date where necessary. The fifth is storage limitation. Job records, images and access notes are kept only as long as needed for the work, warranty, tax or legal reasons. The sixth is integrity and confidentiality. Photos, key-safe codes and access notes need extra care because they can reveal how to enter a property or identify a customer. The seventh is accountability. The business must be able to show how it complies. That includes written records of decisions, policies and basic staff training.

Applying the seven basics to daily work means separating customer data from marketing lists, storing photographs with access controls, and deleting access codes after the job. Key-safe codes and access notes need extra care because a lost phone or notebook can expose entry details. Where software is used for scheduling, invoicing or photo storage, the provider usually acts as a processor. A contract is required between the business and the processor. The business remains responsible for the data. A customer can make a subject access request for a copy of their personal data and other information. The business must respond within one month. Most businesses processing personal data pay an annual ICO data protection fee. The fee is separate from breach reporting and subject access duties. Records of what data is held, where it is stored, who can access it, and when it is deleted support the accountability principle. The same rules cover paper job sheets and digital records. A subject access request can include photographs and emails as well as written records. The business must verify identity and provide the data without undue delay and within one month.

Software providers as processors

Where a tradesperson uses software to manage enquiries, quotes, job records, invoices or photographs, the software provider usually acts as a processor and the tradesperson usually acts as the controller. The controller decides why and how personal data is processed, while the processor handles that data on the controller's behalf. UK GDPR requires a written contract between the two parties before personal data is processed. The contract must set out the subject matter, duration, nature and purpose of processing, the type of personal data and the categories of data subject. It must also require the processor to act only on documented instructions, apply appropriate security, assist with data subject rights and breach notification, and delete or return data at the end of the service. Where sub-processors are used, the contract needs to address authorisation and flow-down of obligations. Tradespeople may hold customer names, addresses, phone numbers, photos and access details, all covered by UK GDPR, so the processor relationship covers ordinary job records as well as special categories if they arise. The contract also supports accountability because it records the agreed allocation of duties between controller and processor.

Hosting arrangements form part of the processor relationship. A software provider may store data in the UK, in another country covered by UK adequacy regulations, or in a third country relying on a transfer mechanism such as the International Data Transfer Agreement or the UK Addendum to standard contractual clauses. The contract and the provider's published information are the practical sources for checking where data is held and which sub-processors are involved. Key-safe codes and access notes need extra care because they can allow physical access to a customer's property, so access is limited to staff and contractors who need it for the job. Photographs can contain personal data, including images of people, vehicle registration plates or interiors, and are handled within the same contract and security framework. If a breach is likely to risk people's rights, such as a lost phone with unprotected job records, it must be reported to the ICO within 72 hours of becoming aware of it. The processor contract supports this by requiring timely notification to the controller, so the controller can assess and report where required. Records of processing and contract reviews help show accountability.

Access requests and retention

A subject access request is a request from a person for a copy of their personal data and other specified information. Tradespeople must respond within one month of receiving the request, subject to any permitted extension under UK GDPR. The response covers personal data held in job records, emails, messages, photographs, invoices and access notes, including key-safe codes where those relate to the individual. The request can arrive by any route, so a request made by phone, email or social media is handled in the same way as a formal letter. Identity may need to be verified before data is disclosed, but the one month period runs from receipt unless the controller needs more information to confirm identity. Where data belongs to another person, or disclosure would reveal information about a third party, that information is redacted or withheld as required. A record of the request, the response and any redactions supports accountability. If the request is complex, the controller must consider the permitted extension and inform the requester within the initial one month period. Clear internal procedures help ensure deadlines are met.

Retention periods for customer data are set by the controller and linked to the purpose for which the data was collected. Records connected with gas, electrical and F-gas work are kept in line with the relevant record-keeping requirements for those activities, not by a single period applied to every job. A tradesperson may also need to keep records for warranties, complaints, insurance and legal claims, so the retention schedule identifies the trigger for review and deletion. Personal data is kept no longer than necessary for those purposes. Photographs and access notes are included in the schedule, and key-safe codes are removed or changed when they are no longer needed. When a software provider is changed, the contract covers return or deletion of data, and the switching guide linked with this article covers the practical steps for transferring records and closing old accounts. A retention schedule records the categories of data, the lawful basis, the retention trigger and the deletion method. Reviews at set intervals help show that the schedule is followed. If a breach is likely to risk people's rights, such as a lost phone with unprotected job records, it must be reported to the ICO within 72 hours of becoming aware of it.

The ICO fee and registration

The Information Commissioner's Office (ICO) charges an annual data protection fee for most organisations that process personal data. For tradespeople, this includes sole traders and small firms handling customer names, addresses, phone numbers, photographs, access details or job records. The fee applies to processing covered by UK GDPR and is separate from other business costs. The amount is set by reference to the size and turnover of the organisation, with different tiers rather than a single flat charge. No figures are stated here because the ICO publishes the current amounts and categories. The self-assessment is provided by the ICO for this purpose. Businesses can use the ICO self-assessment tool to check whether a fee is payable and which tier applies. The tool asks about the organisation's size, turnover and processing. The ICO publishes registration details. A tradesperson who is unsure whether the fee applies can check the position. Paying the fee does not replace other duties, such as keeping records secure, reporting certain breaches within 72 hours or responding to subject access requests within one month. Those duties apply where the relevant conditions are met.

The fee regime is administered by the ICO and is separate from other registration schemes. A business that processes personal data for customer records, quotations, invoices, photographs of completed work or key-safe codes falls within the scope of the fee discussion where the processing is covered by UK GDPR. The ICO's published guidance sets out the categories and current fee levels. Tradespeople can check the self-assessment and the ICO register. If a business's size or turnover changes, the applicable tier can change, so records of the fee position are useful. The fee is not a substitute for a lawful basis, a privacy notice, processor contracts or security measures. Software providers used for job management usually act as processors, with a contract required. Key-safe codes and access notes need extra care. A breach that is likely to risk people's rights, such as a lost phone with unprotected job records, must be reported to the ICO within 72 hours of becoming aware. These are separate compliance points from the annual fee. The fee position can be reviewed when business details change.

Frequently asked questions

Does GDPR apply to sole traders?

Yes, UK GDPR applies to any business processing personal data, including sole traders.

How quickly must a data breach be reported?

Within 72 hours of becoming aware, if it is likely to risk individuals' rights.

Is a lost work phone a data breach?

It can be, depending on what data it holds and how it is protected.

Do tradespeople need to pay the ICO fee?

Most businesses processing personal data must pay; the ICO's self-assessment confirms.

How long can customer data be kept?

No longer than needed, though legal retention rules such as gas safety records apply.