I know it has been some time since you heard from me but the approaching GDPR date of the 25th May 2018 has kicked me up the bottom to resurrect this site and sort out my own approach to how GDPR affects me, my business and my relationship with the readers of this site.
I know there have been many scare stories about GDPR and the fines of €20M or 4% of your global annual turnover (whichever is greater) but in essence it is very logical. If you collect data from anyone you need to know you are accountable for its safe keeping and you are not to abuse it (i.e. use it for a purpose you haven’t disclosed).
There is only one source that I have found I would trust to learn about the effects of GDPR on small business and what audits you need to do and what documents you have to keep and you will find it at Suzanne Dibble’s website here
Please do not hesitate to contact me if you have any questions or concerns about how this may affect your business and what, if any, legal documentation you need to have to protect yourself in case the Information Commissioner ever comes calling.