Lessons from My Solo Data Protection Business
When I set up my solo GDPR compliance business, I threw myself into the work. I loved the freedom, the creativity, and the satisfaction of helping people make sense of data protection. What I didn’t have was a plan for growth or even a clear idea of what I wanted the business to become. It was a rewarding experiment that taught me a lot, but it was also one I eventually chose to end. Here are the lessons I learned along the way.
I didn’t have any ambitions to set up on my own as a GDPR consultant.
I was doing my 9-5 job when I had to explain some personal data basics to a consultant working for the organisation. It was in relation to a data subject access request they’d received because of the work they did for us.
It was very basic: what personal data was, what information to include and exclude. I remember wondering, “how many freelancers and self-employed people don’t know this?”
And there I thought I could fill a gap.
Setting up a Data Protection Business
I admire entrepreneurs and business owners. I think running your own company requires courage, certain level of optimism and hustle (all of which I had varying levels of).
I was sure I was going to set up a limited company rather than being a self-employed individual because of the protection it would offer.
Companies have separate legal personality from the people who run them (the directors). This means that if someone was unhappy with the service and things went really bad (i.e. no money left to reimburse for the bad service), the company would go down instead of the director. There are some exceptions to this, but the bar for going after the director is high.
Setting a bank account and registering with Companies House was very smooth - I was using a digital bank at the time, so I wonder if I would have had the same experience with a high-street bank.
I would suggest you find yourself a desk sharing space or an accountant whose address you can use for your public company address on Companies House. Otherwise, you have to publicise your home address.
When choosing a company name, consider:
Searching the UK IPO trademark register so you don’t accidentally infringe a registered trademark.
Registering a trademark for the name itself.
Paying for different domains, e.g. company.co.uk, company.com, to avoid someone else using a similar name but different domain.
You should also be careful saying you offer “legal services” to avoid misunderstandings that you may in an any way provide “legal activities”. There are some “reserved legal activities” under section 12 of the Legal Services Act 2007 that only qualified legal professionals (e.g., solicitors) can carry out.
Finally, don’t forget professional indemnity insurance.
Marketing your Company Offering
I had no idea what to do with promotion and marketing. I built and wrote my own website, which was fun, but beyond this, the marketing aspect of my business I found all-consuming.
I wasn’t active on LinkedIn at the time so that wasn’t an option. I was also struggling with telling the world Sofia had set up a GDPR business company and people should pay for the advice I could give. I was also much younger and, to be brutally honest, the whole thing sometimes felt too serious and too big.
My marketing plan was:
Make my website SEO-friendly by researching keywords and adding them to main headings and web copy.
Pay Google for ads so that when someone googles in panic: “how do I answer a DSAR?”, I come up in search.
And that was all. I spent hundreds of pounds on Google Ads, which was how I got my clients. The pressure to do marketing while wanting to preserve my privacy was hindering the whole business.
I also tried different versions of my services pages, different pricing, free consultations. Some of it helped, some of it was just money for Google. You learn every day.
You Need People and Tools to Help You
Speaking of people, I mean one very specific person - an accountant. Get yourself an accountant and don’t look back. It can be a significant fee for a business but you get professional advice in a regulated area.
I should have also gotten myself a marketing consultant.
When you run a business and it’s just you, you could probably still treat it as a hobby and try not to spend too much on tools for the job. However, if you want it to scale and especially if you start hiring people, penny-pinching does not get you far.
Having a Strategy
Before you start, ask yourself what you want to achieve with your business.
I, for example, wasn’t particularly clear on that – I liked the “doing”, helping people with data protection and providing them with a tangible outcome they could take away. I learned a lot about business management, but couldn’t break through in the industry this way.
Life decided it for me, however, and I voluntarily wound up the business before starting another job. I was sad but also relieved. It wasn’t the right time but it was a good time to try.
Would I Do it Again?
Yes, I would. I’d plan more. I’d think about my services and rates before I jump in. The difference would be that the process wouldn’t be as daunting as the first time. I was anxious then, now it would be like any other compliance task.
If you want to stay employed for a while and set up during that time, you should check your contract for any restrictions. The so-called restrictive covenants (“you’re not allowed to approach our clients” type of clauses) are usually for six months. You can see 12 months too, which I’d argue is unreasonably long.
You may also need to tell your employer. Sensible employers won’t mind. Good managers understand that people grow, develop new interests, and sometimes pursue side ventures. Other managers may push back, often for reasons that have more to do with them than with you, but their discomfort doesn’t change your ambition. You’ll either be open about it and still do it, or you’ll leave and do it anyway.