Legal, insurance and safety
Data protection for plant hire companies
UK GDPR basics for plant hire firms: the data you hold, the ICO fee, privacy notices, trackers and CCTV, ID documents, retention and handling requests.
Key takeaways
- Hire firms hold personal data on customers, directors, operators and staff.
- Most businesses that process personal data must pay the ICO data protection fee (from £52 a year for micro organisations).
- Tell people what you collect and why in a privacy notice.
- Trackers and CCTV can capture personal data; use them for clear, limited purposes.
- Keep data only as long as needed and keep it secure.
What data you hold
| Who | Typical data |
|---|---|
| Customers | Names, addresses, phone, email, ID copies, payment records |
| Trade account directors | Names, home addresses, credit checks, guarantees |
| Staff and operators | Contracts, pay, licences, cards, training, accidents |
| Website visitors | Enquiry forms, analytics, cookies |
| People on site | CCTV images; tracker data linked to drivers |
The ICO fee
Organisations and sole traders that process personal data generally must pay the Information Commissioner's Office a yearly data protection fee unless exempt. The tiers are based on size and turnover: tier 1 (micro) is £52, tier 2 £78 and tier 3 £3,763, with £5 off by direct debit. Check the ICO's current fees.
Privacy notice
- Who you are and how to contact you.
- What data you collect and why (the lawful basis).
- Who you share it with: credit agencies, insurers, payment providers, software suppliers.
- How long you keep it.
- People's rights and how to complain to the ICO.
- Link it from your website, quotes and account forms.
Trackers, telematics and CCTV
- Machine trackers mainly track assets, but can show where an operator or driver is; tell staff and hirers.
- Vehicle telematics linked to drivers is personal data; use it for stated purposes such as safety and security.
- CCTV: signs, a stated purpose, limited retention and secure access.
ID documents
Copies of ID help prevent fraud, but store them securely, limit who can see them, and delete them when no longer needed. Consider recording that you checked ID rather than keeping a copy for every hire.
Retention and security
- Set retention periods: accounting records have legal minimums; others shouldn't be kept indefinitely.
- Use strong passwords and two-factor authentication on email and systems.
- Restrict access to what each person needs.
- Lock paper records away; shred when done.
Requests and breaches
- People can ask for a copy of their data; respond within one month.
- Serious personal data breaches must generally be reported to the ICO within 72 hours.
- Keep a simple log of requests and breaches.
This is a summary only. The ICO publishes guidance for small businesses.
FAQs
Common questions
Does a plant hire company need to pay the ICO fee?
Can I keep copies of customers' ID?
Do trackers on machines raise data protection issues?
Keep going
Related guides
Trade accounts and customer onboarding
Account forms, credit checks, limits and guarantees.
Read guide →
Theft prevention
Security, trackers, immobilisers, CESAR and key control.
Read guide →
Hiring your first plant hire employee
Who to hire first and the legal steps.
Read guide →
Plant hire website essentials
The pages, prices and forms that turn visits into bookings.
Read guide →
This guide is general information for people setting up a plant hire business in the UK. It is not legal, tax, insurance or financial advice. Rules and thresholds change, so check current guidance on GOV.UK and take advice from an accountant, solicitor or broker before acting.