Four hundred names. Four hundred addresses, most with a mobile number, and a payment history going back three years. That is a database. So UK data protection law applies to you, the same as it applies to a bank, scaled down to one van.
That is not a threat. GDPR for window cleaners is mostly a handful of things you write down once, then get on with the round. I am not a solicitor and this is not legal advice.
What you can stop worrying about
Data protection for window cleaners attracts a lot of myths. A one-person round needs no data protection officer, and no data protection impact assessment for ordinary cleaning work. No website means no cookies, so no cookie banner.
And no, the law does not stop you keeping a customer's phone number. Holding names, addresses and numbers to do a job people asked you to do is the ordinary business the rules were written around. Know what you hold, say what you do with it, look after it.
The ICO fee, the bit everyone asks about
Two questions: do you pay, and how much.
Do you pay
Processing is anything you do with personal data: holding it, sorting the round, texting from the list. Regulation 2 of the Data Protection (Charges and Information) Regulations 2018 says you pay unless every bit of it falls inside a short list of exempt purposes. Not most. All of it.
The exempt purposes are:
- staff administration
- advertising, marketing and public relations for your own business
- accounts and records
- not-for-profit purposes
- personal, family or household affairs
- maintaining a public register
- judicial functions
- processing without an automated system, so paper only
- certain political representatives
A dashcam, or any camera capturing people beyond your own property boundary, is not on that list, and one non-exempt activity means the whole business owes the fee. That settles it for a lot of cleaners. A photo of a customer's windows, filed against their record, is a smaller worry: it sits under the same lawful basis as the rest of the round. The van camera is what the checklist below is for.
Without a camera it turns on whether a round list used for scheduling and reminders sits wholly inside "accounts and records". I cannot answer that for you. No ICO statement resolves it for a trade like this, and anyone who tells you flatly either way is guessing. Ten minutes on the ICO's self-assessment checklist, or the sole trader line on 0303 123 1113, option 4, settles it for your own setup.
What it costs
Three tiers by size, and a one-van round is the smallest. Tier 1 is £52, or £47 by direct debit thanks to the automatic £5 discount, and it covers any business with turnover up to £632,000, or no more than 10 staff; either on its own is enough.
Not paying costs more. The fixed penalty at tier 1 is £400, and the ICO can push it towards the statutory maximum of £4,350 where there are aggravating factors, ignoring them being the obvious one.
This next bit is my own view, not legal advice. £400 divided by £47 is a little over eight, so eight years of paying comes to £376, less than one penalty. For most one-van rounds the sum is not close, and paying is cheaper than being wrong.
How to register
Online, on gov.uk. Questions about what you do, your name and contact details, then pay. The charge is annual.
Paying is not complying, mind. ICO registration for a window cleaner covers the fee and nothing else; exempt means exempt from the fee only.
When a reminder text becomes an advert
This is the one that catches people, and it turns on one sentence.
Morning, it's Dave. Cleaning your windows tomorrow, please leave the side gate unlocked.
That is a service message. Information only, no promotion, outside the marketing rules.
Morning, it's Dave. Cleaning your windows tomorrow. While I'm there, gutters are 10% off.
That is direct marketing, and not just the second sentence. The whole message becomes marketing, and PECR applies: the Privacy and Electronic Communications Regulations, the rules covering marketing by text, email and phone. Where the ICO writes "electronic mail" it means texts as well as emails, so this is about the message you send from the van.
The five limbs
You need consent, or the soft opt-in, the exception that lets you market to people who already bought from you without asking first. All five limbs have to be met, not four:
- you got the details directly from the person
- in the course of a sale, or negotiations for one
- you are marketing your own similar goods or services
- you gave them a simple opt-out when you collected the details
- you give an opt-out in every message after that
Customers already on the round
Bullet four is where most rounds fall down. If you never offered an opt-out when you took someone's number, and hardly anyone did, that limb can never be met for them. The soft opt-in is closed for the book you already have.
What is left is consent. Ask, and get a yes, but not by text: the ICO treats a message asking permission to market as marketing itself. Ask at the door on the next clean, or on paper, and note who said yes and when. Offer the opt-out as you take the number from now on, and that limb is met going forward.
Either way, every marketing message needs an opt-out in it, a "reply STOP and I'll leave it". That part is never optional.
PECR only covers electronic communications, so paper and knocking doors are a different world.
Your lawful basis, and the notice that goes with it
Two records, and neither goes to the ICO.
Picking a basis
You need a lawful basis for each thing you do with customer data, recorded with your reasons. There is no ICO form. The record is yours: a notebook page, or a file kept with the accounts.
Doing the clean the customer asked for maps onto contract. Keeping a round list, holding history and chasing what you are owed commonly sit under legitimate interests, which needs a three-part test: the purpose, whether you really need the data for it, and whether your interest outweighs theirs. Ten lines covers it. A list of no-answers from canvassing is personal data too, usually legitimate interests, same three-part test.
What the notice has to say
People have to be told, in plain language, when you collect the data. A privacy notice covers:
- your name and contact details
- what you use the data for
- your lawful basis
- the legitimate interests, where you rely on them
- who else sees it
- any transfers overseas
- how long you keep it
- people's rights, including complaining to the ICO and withdrawing consent where that applies
- whether giving you the data is a statutory or contractual requirement
- any automated decision-making, meaning a decision taken by software on its own, which a spreadsheet flagging who is due is not
- where you got it, if it came from someone else
No website needed. The ICO says so directly: print copies, attach it to an email, or say it out loud. The free ICO generator builds one by sector, and ours is a finished example.
Keeping it safe, and the day the phone goes missing
Short law, longer advice, then the bad night.
Law, then advice
The legal duty is short: keep the data secure with measures appropriate to the risk, and be able to explain what you chose. No statute names a password rule.
The rest is advice, not law, though the ICO's three tips for sole traders are unglamorous and correct. In practice: three random words for a password, multi-factor authentication on, screen locked, business email separate from personal, backups encrypted and kept away from the live data. A round living in one file on one handset is a backup problem before it is a data protection one.
The phone on a wall in Baddow Road
It is a personal data breach if security was breached. Contain it with a remote wipe, then assess the risk. You report to the ICO within 72 hours of becoming aware, but only if the breach is likely to risk people's rights and freedoms. Log it either way, with your reasons if you decide not to. The log is yours, not a form you send anywhere: date, what went missing, what you did, why you did or did not report it.
Encryption is the hinge
The ICO's own case study describes a lost device first judged not reportable. It became reportable once it turned out not to be encrypted, because nobody could rule out that someone had got in. A locked, encrypted, remotely wipeable phone genuinely changes the answer.
Two jobs tonight, while the phone is in your hand. iPhones and Android handsets encrypt themselves once you set a passcode or PIN, so a proper screen lock is what switches encryption on. And a remote wipe only works if find-my-phone was on beforehand, Find My on an iPhone, find my device on Android. You cannot turn that on from a wall in Baddow Road.
Data requests, and deleting people
A subject access request can be made verbally, in writing, or through social media. Someone at the door saying "send me what you've got on me" counts. You have a month to answer, usually free.
Deletion is narrower. The right to erasure does not override a legal obligation, so you can drop someone from the round and your marketing while keeping what the taxman needs. No data protection rule sets a number of years. HMRC does: at least five years after the 31 January deadline for that tax year.
Complaints, since 19 June 2026
A duty, this one, not background. Since 19 June 2026 you acknowledge a complaint within 30 days and respond without dragging it out. That means how you handled someone's information, not a smeary pane.
It comes from the Data (Use and Access) Act 2025, which amends UK GDPR and the Data Protection Act 2018 rather than replacing them, phased in between June 2025 and June 2026. Some ICO guidance pages still carry an "under review" banner as a result.
If you are selling the round
Selling up? Handing a round over means sharing a database of named individuals: both sides need a lawful basis, the arrangement goes in writing, and the buyer must give those customers privacy information within a month and cannot inherit your soft opt-in.
Where the round list lives
Most of the above assumes you can answer one question quickly: what is on my list, and where does it live. Harder than it sounds when the round is spread across a spreadsheet, a contacts list and a paper book.
RoundWiz keeps the round in one place, backed up, with your data exportable whenever you want. £7.99 a month, 30-day free trial, no card to start. It does not send your texts for you, so the marketing rules above stay yours.