Legal aspects of running a business (UK): UK GDPR, Companies Act 2006 and corporation tax

What are you legally obliged to do when running a business, and what happens if you do not do it? Business owners have a great deal to think about, and complying with the laws that affect the business is one of the things that gets pushed down the list. In my view there are three main laws to understand: UK GDPR, the Companies Act 2006 and the Finance Act 2004. Below I explain what each requires, the consequences of non-compliance, and the one risk that in my experience does the most damage to small businesses. This is not a complete list of every law that touches a business, but if you get these three right you have covered the areas that most often cause problems.

To make it concrete, assume you have started a new business, say a tech business, and you want to know which laws you need to be aware of and what you must do to comply with them.

What is UK GDPR?

UK GDPR is the data protection law the UK adopted following its exit from the European Union. It deals with personal data, which is information that identifies or personally identifies individuals. Examples of personal data include email addresses, phone numbers, full names and addresses. Almost every business holds some of this, which is why UK GDPR is the first law on the list.

What is a data controller?

The first thing you need to do to comply with UK GDPR is work out whether you are a controller or a processor of personal data.

A controller, in short, is the entity that collects personal data directly from data subjects. Data subjects are the people whose data you hold. In our example, the tech business would be a controller of the personal data of its own clients, because those clients, the data subjects, are giving the tech business their details.

What is a data processor?

The same tech business could also be a data processor. Suppose it runs an online platform, its clients are themselves businesses, and those clients use the platform to upload details about their own customers. In that case the tech business is processing personal data on behalf of its clients, so it is the data processor of that client data.

Many businesses are both a controller and a processor at the same time, depending on whose data is involved. The tech business in our example is a controller of its own clients' details and a processor of the customer data those clients upload. The distinction matters because the documents you need differ depending on which role you are in.

How to comply with UK GDPR

What you need to do depends on which role you are in.

• As a data controller, you need to have a privacy policy in place that is publicly accessible and gives details to your data subjects of how you are going to process, store and use their personal data.
• As a data processor, you need a data processing agreement in place that specifies how you are going to process the data and how you are going to protect it, for example from security breaches.

It is important to keep in mind that compliance with data protection law is relevant for any business, no matter how big or small. A one-person consultancy holding a spreadsheet of client email addresses is handling personal data just as a large platform is. The consequences of not following UK GDPR include being fined and possibly being sued by the people whose data you failed to protect.

Companies Act 2006: what companies must do

The second main law is the Companies Act 2006. This is the legislation that deals with the running of a limited company, and other entities such as the limited liability partnership. It is a huge piece of legislation with hundreds of sections, so I will not attempt to summarise it. But if you run a limited company there is one thing you should definitely be aware of, because it comes up every time the company does anything significant.

The directors and the shareholders of the company need to keep written records of their decisions. If you own a limited company and you are looking to create new shares, transfer your shares or amend your articles of association, you need to keep written records of those decisions. For example, the board of directors needs to keep its board minutes at the company's registered office address for at least 10 years.

The consequences of not following the Companies Act depend on which section you have not followed. Typically, the consequences of deliberately not following the Act are fines, and possibly your company being struck off the register at Companies House. Keeping proper written records of decisions is not difficult, but it does need to become a habit from the start rather than something you try to reconstruct years later.

Tax and accounting records (Finance Act 2004)

The third main law is the Finance Act 2004. This Act matters for anyone running a limited company because it makes very clear that a limited company must submit a corporation tax return to HMRC and pay corporation tax.

The reason I include it here is practical. To be able to submit a corporation tax return, you need to be doing bookkeeping: keeping records of the transactions your company has, the money in and the money out. Typically that means appointing an accountant to help you with these compliance obligations, because few business owners have the time or the knowledge to do it properly themselves.

The consequences of not complying, for example by not submitting a corporation tax return, include late payment fees, interest on the corporation tax due, penalties, and even criminal prosecution.

Terms and conditions to limit liability

On the subject of legal issues and their consequences, here is something many business owners do not expect: in my experience, the most risk typically comes from simply dealing with your clients.

Clients might claim against you and take you to court if, for example, you are hacked and their personal data is stolen, if you are negligent, or if your products are faulty and cause them loss. Legal claims can be absolutely brutal to a business. It is not uncommon to find that one of the reasons a business went under was a claim brought by a client.

For that reason it is extremely important that every single business has bespoke terms of business in place. Your terms and conditions should specify what you are offering and how you limit your liability. They are the rules of the relationship between you and your clients, and because you draft them, you get to set those rules. Generic terms copied from elsewhere rarely describe what your business actually does, which means they rarely protect it when a claim comes in. For how to draft them properly, see how to write a contract.

Next steps

Start by deciding whether your business is a data controller, a data processor or both, and put the right privacy policy or data processing agreement in place. Make sure your company records decisions in writing and keeps board minutes at its registered office, and get an accountant on board so the corporation tax return is never missed. Then have bespoke terms of business drafted, because that is where the real exposure sits. For what to do before you start trading, see legal steps to start a business, and speak to a commercial solicitor if you are unsure where you stand.