A small organisation may hold personal information in more places than it expects: enquiry emails, customer files, staff records, shared drives and marketing lists. Before drafting a policy or adopting another tool, map what is actually being collected and why.
Follow the information
List the categories of information, where they enter the business, who can access them and how long they are kept. Identify suppliers that receive data, including cloud software providers. The exercise often reveals files that are duplicated or retained without a clear reason.
Make responsibilities visible
Decide who handles requests from individuals, who checks access when staff change roles and who responds if information is lost. The ICO provides a self-assessment checklist for small organisations to identify practical next steps. A checklist is a starting point; obligations depend on the data and the activity.
Use the ICO's small-organisation guidance.