Course description

If your business, charity or club keeps information about people (customers, staff, volunteers, members, donors or the people you support), data protection law applies to you. The rules can seem written for big companies with legal teams. This course turns them into plain English and simple steps a small organisation can actually take, from paying the data protection fee to answering a subject access request, sending a marketing email or dealing with a data breach.

It's a full course, not a quick tour. There are 10 sections and 50 written lessons, and every lesson ends with a practical task you can do for your own organisation. You follow Lucasta, an office manager at a small heating firm in Leicestershire who is also a trustee of a local befriending charity, through a year of putting things right: her first data map, a privacy notice rewrite, a subject access request from a former apprentice, a stolen phone, an email sent to the wrong volunteer, new marketing rules and an annual review. Every section has a worksheet, model answers, a cheat sheet and ready-made templates and spreadsheets.

What you'll learn

• Getting started: what UK GDPR, the Data Protection Act 2018 and PECR cover, personal and special category data, who is responsible, and the data protection fee.
• Principles and lawful bases: the seven principles, choosing a lawful basis, consent done properly, legitimate interests and special category conditions.
• Knowing your data: a data map, a record of processing, a retention schedule, working with suppliers and sending data abroad.
• Privacy notices: what to tell customers, service users, staff, volunteers and applicants, and how to word your forms.
• Rights and complaints: recognising requests, subject access step by step, the other rights, and the complaints process every organisation now needs.
• Security and breaches: simple measures for devices, email and paper, volunteers using their own phones, and what to do in the first 72 hours after a breach.
• Marketing and monitoring: email and text marketing rules, the charitable purpose soft opt-in, cookies, CCTV, photos and staff monitoring.
• Keeping it going: training staff and volunteers, a short policy pack and a yearly review.

Who it's for

Small business owners and managers, admin and office staff, and charity trustees, staff and volunteers who handle information about people. It covers the changes from the Data (Use and Access) Act 2025 that apply to small organisations. The course gives practical, general information, not legal advice, and Rootlet is independent of the Information Commission. It ends with a final project: a data protection health check and a 90-day action plan for a mobile hairdresser.

What will I learn?

• Explain what UK GDPR, the Data Protection Act 2018 and PECR mean for a small organisation, including the 2026 changes
• Work out whether you need to pay the data protection fee, and who is responsible for what
• Apply the seven principles and choose the right lawful basis for each thing you do with personal data
• Build a data map, a record of processing and a retention schedule, and check your suppliers
• Write clear privacy notices for customers, service users, staff and volunteers
• Handle subject access requests, other rights requests and data protection complaints on time
• Put simple security measures in place and respond to a personal data breach within 72 hours
• Follow the rules for marketing emails and texts, cookies, CCTV and monitoring, and keep it all going with training and a yearly review

Frequently asked questions