UK GDPR for tradespeople: what you actually need to do

If you store customer names, addresses, photos of their property or any other identifying detail, UK GDPR applies to you. The good news: for most trades businesses the obligations are straightforward.

The six lawful bases — pick the right one For most customer records you will rely on **contract** (you need their data to do the job) or **legitimate interests** (sending them a service reminder). For marketing emails to non-customers you need **consent**.

What you must do, in plain English - Register with the ICO (it costs £40–£60 a year for most trades) - Maintain a record of what data you hold and why - Have a privacy notice on your website - Respond to data subject access requests within 30 days - Report serious data breaches to the ICO within 72 hours

Photos of customer property Before/after photos are data if they identify the property or the customer. Get permission to use them for marketing in writing — a tick-box on your acceptance form is enough. Never post a recognisable house number on social media without explicit consent.

Marketing emails The PECR rules layer on top of UK GDPR for electronic marketing. You can email existing customers about similar services (the "soft opt-in") provided you offered an unsubscribe at the point of collection and on every email. New leads need explicit consent.

Retention Do not keep customer data forever. Seven years for tax-relevant records (HMRC), two years for unsuccessful quotes is a sensible default.

How TradeMatrix helps Every TradeMatrix customer record has a consent log, an unsubscribe link on every email, automatic retention policies, and a one-click data export to satisfy a SAR. Our [privacy policy](/legal/privacy) shows how we apply the same standards to our own processing.