Data protection for restaurants: your UK GDPR duties

Data protection is the compliance area restaurants most often forget they fall under — but you almost certainly do. The moment you hold a staff rota, take a booking, run a CCTV camera or email a regular about an offer, you're processing personal data, and the UK GDPR applies. The good news: for a typical independent restaurant the duties are manageable. Here's what they are.

What law applies, and what counts as personal data?

Your obligations come from the UK GDPR and the Data Protection Act 2018, regulated by the Information Commissioner's Office (ICO). Personal data is anything that identifies a living person — and in a restaurant that's more than you'd think:

• staff records — contracts, payroll, right-to-work, disciplinary files;
• customer bookings and contact details;
• CCTV footage of identifiable people;
• a marketing list of regulars.

Registering and paying the ICO fee

Unless you're exempt, you must register with the ICO and pay an annual data protection fee. The fee is tiered by size and turnover, and most small restaurants sit in the lowest tier. It's an inexpensive, once-a-year administrative step — but skipping it when you should pay is itself something the ICO can fine you for, so it's worth doing early.

The core duties in plain terms

• Have a written policy — what data you hold, why, your lawful basis, retention periods, security and how people exercise their rights.
• Use data only for clear, lawful purposes — and not quietly repurpose it (e.g. using a booking email for marketing without consent).
• Keep it secure — access controls, sensible retention, and not holding data longer than you need it.
• Honour individuals' rights — including requests to see (a subject access request) or delete their data.
• Report serious breaches to the ICO within 72 hours where there's a risk to people.

CCTV and marketing: the two that trip people up

CCTV capturing identifiable people is personal data — you need a clear purpose, signage, secure storage and a sensible retention period. Marketing emails and texts are governed by PECR as well as the UK GDPR: you generally need consent, and every message must offer an easy opt-out. A "dairy-free specials" mailout to people who only ever gave you a booking email is exactly the kind of slip that draws complaints.

Do you need a DPO? Almost certainly not

A statutory Data Protection Officer is only required for large-scale or sensitive processing — a typical independent restaurant doesn't meet that bar. You don't need a formal DPO, but you should name one person (usually the owner or manager) as responsible for data protection and the point of contact for requests and breaches.

Keeping the policy current and the team aware

Data protection isn't a training-heavy area, but two things still need keeping alive: the policy itself, kept current as your practices change, and staff awareness of the basics — how to handle a customer's data, what to do if there's a breach. frunt holds your data protection policy alongside your other compliance documents, versioned and dated, and can turn the staff-facing essentials into quick induction with a record that the team has seen them. Get started with frunt, or book a walkthrough.