Twelve steps to GDPR nirvana; the final cream crackers!

Paula Veysey Smith • 5 March 2018

Twelve Steps to GDPR nirvana – the final cream crackers!

The Information Commissioner’s Office (ICO) have published a twelve-step guide for compliance; we looked at the first of those steps last week but as I said then is it a bit like trying to eat cream crackers. So, tea at the ready, let’s look at the second six steps and how they relate to the small business.

1. Consent

You should review how you seek, record and manage consent and whether you need to make any changes. Refresh existing consents now if they don’t meet the GDPR standard. The ICO has published detailed guidance on consent under the GDPR, and you can use their consent checklist to review your practices. Consent must be freely given, specific, informed and unambiguous. There must be a positive opt-in – consent cannot be inferred from silence, pre-ticked boxes or inactivity. It must also be separate from other terms and conditions, and you will need to have simple ways for people to withdraw consent. Consent has to be verifiable and individuals generally have more rights where you rely on consent to process their data. You are not required to automatically ‘repaper’ or refresh all existing DPA consents in preparation for the GDPR. But if you rely on individuals’ consent to process their data, make sure it will meet the GDPR standard on being specific, granular, clear, prominent, opt-in, properly documented and easily withdrawn. If not, alter your consent mechanisms and seek fresh GDPR-compliant consent, or find an alternative to consent.

To me, this is one of the biggest GDPR impacts and I would urge you all to start now looking at this area.

2. Children

You should start thinking now about whether you need to put systems in place to verify individuals’ ages and to obtain parental or guardian consent for any data processing activity.
There are specific rules that bring special attention for children’s personal data and if you believe that this area of compliance will impact your business please do seek further ICO guidance.

3. Data Breaches

You should make sure you have the right procedures in place to detect, report and investigate a personal data breach. This is an area that will impact larger corporations more as they will now be legally responsible for disclosing breaches at the time they happen, meaning that any member of the public will know straight away if their personal data has been affected; this can only be a good thing.

For smaller entities I believe that we should act by looking at how we hold our data and what risks there are. I have an announcement to make next week about how M:Power has acted to properly secure the personal data it holds as I have already reviewed this step to ensure that your data is as safe as it can be.

4. Data Protection Impact Assessment

It has always been good practice to adopt a privacy by design approach and to carry out a Privacy Impact Assessment (PIA) as part of this. However, the GDPR makes privacy by design an express legal requirement, under the term ‘data protection by design and by default’. It also makes PIAs – referred to as ‘Data Protection Impact Assessments’ or DPIAs – mandatory in certain circumstances. If you feel that a DPIA may be mandatory in your case, please consult the ICO guidance.

It is good for all small business to carry out an assessment and document this. The assessment will identify the most effective way to comply with GDPR obligations and also meet individuals’ expectations of privacy. And the PIA is an integral part of taking a privacy by design approach. Although this may sound slightly scary it should not take too long for you to complete a PIA and it will show if you do have any areas that need improvement or of high risk.

Nearly there – just two more crackers to go . . .

5. Data Protection Officers

You should designate someone to take responsibility for data protection compliance and assess where this role will sit within your organisation’s structure and governance arrangements. In most cases that will be you!

6. International

If you do operate in more than one EU member state, you will need to determine your lead supervising state and document this. For most small business in the UK this authority will be the UK but if you do have a more complicated framework with more than a single establishment in the UK then again, I would advise you review the ICO guidance for this area.

So, time for that glug of tea as we are now done. All entities in the UK that hold personal data in whatever form are legally required to comply to the GDPR requirements. As I said right at the beginning those of us who were already working under DPA are potentially most of the way there but it is vital that you consider these twelve steps and act on them now to ensure your compliance. I believe that, with carefully consideration, this will not become just another administration burden and the quicker you act the easier it will be to ensure that you are compliance by 25th May; that is the way to achieve GDPR nirvana.

A calendar with a calculator and a cup of coffee on a table
by Paula Veysey-Smith 9 July 2025
With many tax payers facing yet another payment to the HMRC on the 31st July let’s answer some frequently asked questions about the Payments on Account System. When was this system first introduced? The Payments on Account system was introduced in the 1996–97 tax year , as part of the Self-Assessment overhaul. Before then, HMRC had a fragmented and less predictable system for collecting income tax from self-employed individuals and others outside the PAYE system. It was introduced to ensure that taxpayers pay tax closer to when they earn their income , rather than facing a large lump sum payment long after the end of the tax year. Why did HMRC introduce Payments on Account? There are three key reasons why HMRC introduced this system: Cash flow for HMRC : This undoubtably is a driving reason for Payments on Account as it spreads the inflow of tax revenue more evenly throughout the year rather than relying on one big payment annually after a tax demand was sent to the tax payer. Encourages prompt payment : Tax is collected in advance (based on the prior year’s bill), reducing the risk of default or late payments. Helps tax-payers budget : Although first going into the Payment on Account system is painful as your tax bill, and half of it again, need to be paid on 31st January. Once in though, it does avoid the shock of a large single tax bill by splitting the liability into two smaller payments. So how does the Payments on Account system work? Who Needs to Make Payments on Account? You’ll need to make payments on account if your tax bill is more than £1,000 and less than 80% of your tax is collected at source (e.g., via PAYE). When Are Payments on Account Due? There are two payments each year: 31 January – First payment on account for the current tax year 31 July – Second payment on account for the current tax year Each is 50% of your previous year’s tax bill (excluding Class 2 NICs and student loan repayments). Example: Let’s say your tax bill for the 2023/24 tax year is £6,000 . On 31 January 2025 : You pay the £6,000 balance for 2023/24 Plus a £3,000 payment on account for 2024/25 (50% of £6,000) On 31 July 2025 : You pay another £3,000 as the second payment on account for 2024/25 So by July 2025, you've prepaid £6,000 towards your 2024/25 tax bill. What Happens When You File Your Next Tax Return? When you submit your 2024/25 return: If the actual tax bill is £7,000 , you’ve already paid £6,000 , so you owe £1,000 by 31 January 2026. If it’s only £5,000 , you’ve overpaid and can get a £1,000 refund or offset it against future payments. If the bill is £7,000 your tax payment will be: on 31st January 26 £1,000 balance on the 2024/25 return bill AND half of the £7,000 (£3 500) balancing payment so £4,500 in total. £3,500 balancing payment on the 31st July 26. Can You Reduce Payments on Account? Yes you can. If you expect your income to fall, you can apply to reduce them through your HMRC online account or on the paper form SA303. But if you reduce them too much, HMRC may charge interest on the underpaid amount. Will Making Tax Digital for Self-assessment change the Payments on Account System? The short answer is No! The longer answer is watch this space!! Many of us professionals believe that with quarterly reporting, quarterly paying will soon follow! For more information on Making Tax Digital for Self-assessment please see our article at: https://www.mpoweraccounting.co.uk/how-will-i-be-affected-by-making-tax-digital-for-income-tax-mtd-for-itsa The Payment on Account system often causes much confusion with self-assessment tax payers. At MPower Accounting we are used to helping our clients understand when payments need to be made and how they have been calculated. As an added service we will always send a payment reminder to clients early in July so they are not caught out. We are also delighted to work with clients who want to complete their self-assessment tax returns early to determine if they are able to reduce the July Payment on Account. Do contact us if you’d like help with Payments on Account and anything to do with your self-assessment
by Paula Veysey-Smith 5 June 2025
The Power of Mentorship in Tracy Bland’s Success
Working from home
by Paula Veysey-Smith 22 May 2025
Do you work from home? If you do, either full-time or part-time, you may be eligible to claim certain expenses either against your own taxes or your Limited Company ones. Many factors will determine what you can claim such as working location, employment status (employee, self-employed, company director), and how much of your home is used for work. What can I claim as an employee of a company? You can claim: A flat-rate allowance of £6 per week (or £26 per month) without needing to provide evidence of expenses. This is the simplest method and can be claimed via your tax code or tax return. The actual costs (if you don't use the flat rate) which can include a proportion of the following: Heating and electricity Internet and phone bills Water (if it’s metered and usage is clearly work-related) You cannot claim rent or mortgage interest unless you're self-employed. These expenses can be claimed via HMRC’s online portal if they have not already been reimbursed by your employer! What can I claim if self-employed (sole trader or via a Partnership)? Here you have two options: 1. Simplified Expenses (Flat Rate) Based on hours you work from home each month: 25–50 hours/month → £10/month 51–100 hours/month → £18/month 101+ hours/month → £26/month 2. Actual Expenses Method You can claim a proportion of: Rent or mortgage interest (not capital repayments) Utilities (gas, electricity, water) Council tax Internet and phone Cleaning and maintenance Home insurance (if work-related) You’ll need to work out the percentage of your home used for business, usually by the number of rooms (not including bathrooms, corridors, storage space) or square footage. One word of warning is never claim the whole use of a room for business as every room will have duality in use. This is also important if you own your home as a room declared purely an office could attract Capital Gains Tax when the property is sold. We suggest that any room should only be claimed at 90% for business. And only one room can be used, not a multiple! These costs should be included on your Self-Assessment tax return. Can I make a claim for these expenses in my Limited Company? Yes, you most certainly can. At MPower Accounting we not only recommend using the actual expenses method as set out above, we provide our clients with a bespoke spreadsheet to calculate these expenses, and others such as mileage, on a month-by-month basis. These amounts can then be claimed as expenses to the Company and paid out to you. It is one of the tax efficient methods of taking money from your business. Capturing and calculating monthly your regular working from home expenses is the best way of ensuring they are recorded correctly. To help you do this we are offering a free download of the spreadsheet usually only available to our clients; please use the link below to get this. Paying taxes is a necessary evil but I am a firm believer in minimising this liability for both individuals and companies. Correctly claiming working at home expenses is one way to reduce your tax bill. Please do contact us if we can help you further identifying all the expenses you can claim and also for further assistance in how to correctly use and populate the downloaded template.
by Paula Veysey-Smith 28 April 2025
Key changes in Employer National Insurance (NI) rates and thresholds for the 2025-26 year have meant advice on the tax efficient salary for Directors has significant altered.
More posts