Rules and ethics
Part of Business licences rules and ethics: a publisher's guide
Data protection in business licences: from submission to safe disposal
Protect personal information in England business-licensing journeys through purpose mapping, minimisation, access controls, retention and safe research.
Licensing work can gather identity, contact, premises, payment and supporting-document information. A tidy case file is not automatically a proportionate one. Start by asking why each field is needed, who will use it and when it can be removed.
What to take away
- Map every field to a stated purpose and keep speculative future uses out of the justification.
- Separate what goes to the authority from any copy a supplier keeps after supporting the user.
- Set retention by record type rather than applying one blanket period to all licensing data.
- Walk through the journey from first enquiry to deletion and fix gaps before adding platforms.
Map data to a purpose
The Information Commissioner's Office's guide to data protection principles explains principles including purpose limitation, data minimisation, accuracy, storage limitation and security. Create a field-level inventory for discovery, application support, payment, renewal and research.
Field inventory by purpose
- Discoveryminimum contact details
- Applicationverified licence evidence
- Paymenttransaction reference only
- Renewaldates and status
- Researchscreening details, no identifiers
The governing framework is the UK GDPR and the Data Protection Act 2018, and the ICO is the regulator. For an authority the lawful basis is usually public task, while a supplier supporting an application relies on contract and research recordings rely on consent.
An inventory row records four things: the field, its purpose, who uses it and the trigger for deletion. One illustrative row:
| Field | Purpose | Who uses it | Deletion trigger |
|---|---|---|---|
| Director date of birth | Identity check for the application | Licensing officer, applicant | When the case closes, unless the licence is live or a dispute is open |
Do not collect an entire document if a smaller verified item meets the purpose. Keep speculative future uses out of the justification.
Separate official submission from supplier storage
The Food Standards Agency's registration service collects operator, establishment and activity details for routing a food registration. A commercial helper does not automatically need to retain every item after it has supported the user. Record which information goes to the authority and which copy, if any, the supplier keeps.
Authority copy vs supplier copy
Authority
- Operator details
- Required
- Establishment details
- Required
- Activity details
- Required
- Payment data
- As required
- Test data
- Never
Supplier
- Operator details
- Only if needed
- Establishment details
- Only if needed
- Activity details
- Only if needed
- Payment data
- Reference only
- Test data
- Use for demos
Use test data for demonstrations. Production credentials and real applicant files should not appear in training screenshots or sales decks.
Restrict case access and manage leavers
Many English routes are local. GOV.UK's council finder identifies the council website from a postcode. Store the verified authority contact in the case record so staff do not send personal material to an unconfirmed address.
Restrict case access by job responsibility, give deputies a controlled recovery path and review shared links. When a supplier or employee leaves, remove access and confirm how records are returned or deleted.
Set retention by record type
Application evidence, authority decisions, marketing leads and research recordings do not require one blanket period. Document the operational or legal reason for each retention choice. Pause routine deletion where a valid dispute or preservation requirement applies, with the decision recorded.
The periods below are typical starting points. The statutory scheme, any live dispute and the lawful basis decide the actual period.
| Record type | Typical period | Reason |
|---|---|---|
| Application evidence | Life of the licence plus six years | Supports the decision and answers late disputes |
| Authority decisions | Six years from the decision date | Limitation Act 1980 allows six years for simple contract claims |
| Marketing leads | 12 to 24 months from last contact | The purpose fades once the person stops engaging |
| Research recordings | Until the analysis is signed off | Consent covers the project, not open-ended reuse |
Protect research participants
Government Digital Service guidance on planning user research helps connect recruitment and methods to a real decision. Collect only the screening details needed, explain recording and deletion, and remove identifiers from analysis where possible. Consent to an interview does not authorise unrestricted reuse of a licensing file.
Vet suppliers and plan for recovery
Before a platform receives real case files, document what it processes, where access is granted, how records can be exported and what deletion means in practice. Review sub-processors and support access rather than relying on a security badge alone.
Ask for written processor terms, a current sub-processor list and a written deletion confirmation at the end of the contract. Use a representative synthetic case to test permissions, export and account closure.
Plan for mistakes and service interruption. Staff need a route to report a misdirected document, unexpected disclosure or inaccessible account promptly. Preserve the facts needed for the organisation's response without circulating the material more widely. Where a breach meets the reporting threshold, report it to the ICO within 72 hours of becoming aware of it.
The appropriate legal and regulatory steps depend on the incident, so follow the approved data-protection process and obtain specialist advice where required.
For continuity, maintain authority references and critical dates outside a single supplier account in a controlled form. Recovery should restore the case history without creating uncontrolled duplicate archives.
Finish with a walkthrough from first enquiry to deletion. Ask the data owner to show an export, access removal and scheduled deletion on safe records.
Document anything that relies on one person's memory or an unavailable supplier function. Identify duplicate stores, exports with no owner and fields no one can explain. Fix these gaps before adding another form or platform.
Before you act
- Create a field-level inventory across discovery, application, payment, renewal and research.
- Record which information goes to the authority and which copy the supplier keeps.
- Restrict case access by job responsibility and review shared links.
- Document the operational or legal reason for each retention choice.
- Remove access when a supplier or employee leaves and confirm deletion.
Common questions
How should an organisation decide which fields to collect during licensing?
Ask why each field is needed, who will use it and when it can be removed. Create a field-level inventory covering discovery, application support, payment, renewal and research. Do not collect an entire document if a smaller verified item meets the purpose, and keep speculative future uses out of the justification.
What should be checked before a platform receives real case files?
Document what the platform processes, where access is granted, how records can be exported and what deletion means in practice. Review sub-processors and support access rather than relying on a security badge alone.
How should staff handle a misdirected document or unexpected disclosure?
Staff need a prompt route to report a misdirected document, unexpected disclosure or inaccessible account. Preserve the facts needed for the organisation's response without circulating the material more widely. The appropriate legal and regulatory steps depend on the incident, so follow the approved data-protection process and obtain specialist advice where required.
