Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, what assessment she has made of the potential effect of the General Data Protection Regulation on small businesses.

The UK worked during negotiations to ensure that the obligations arising from the regulations are greater on an organisation only if the risk their activity poses to an individual is high. Organisations which already operate at the standard set by the Data Protection Act 1998 should be well placed to implement the new data protection framework.

Although businesses will have to make themselves familiar with the new regulation and to what extent it applies to their operations, there are resources on the Information Commissioner's Office (ICO) website (ico.org.uk) to help SMEs and those employing fewer than 250 people to prepare for the data protection regime. In addition, the ICO has launched a dedicated helpline service for organisations employing 250 people or fewer and has updated its SME toolkit to reflect the requirements of GDPR. The ICO continue to develop further guidance on both the Bill and GDPR to support the preparations of organisations.