Data Protection for Stove Installers: What You Actually Need to Do With Customer Information

Every job you take on starts with someone's name, address, phone number, and usually a few photos of their living room before you've even quoted. That's personal data, and the moment you're collecting it electronically, UK GDPR applies to you in exactly the same way it applies to a bank or a hospital. Most installers have never registered with the Information Commissioner's Office, never thought about how long they keep old customer files, and assume this is a problem for bigger companies. For a lot of them, it isn't optional.

Here's what the rules actually require, where the genuine exemptions sit, and what it costs to get it wrong.

Do you actually need to pay the ICO fee?

Almost certainly yes, if you're running job records, invoicing, or a CRM electronically. The exemptions only cover processing done solely for a short list of purposes: staff administration, advertising and marketing, accounts and records, and a handful of others like not-for-profit activity or purely manual paper files with no electronic system at all. A stove installer storing customer names, addresses, job history, and photos on a laptop or in cloud software doesn't fit any of those categories cleanly, because you're processing data to deliver a service to the customer, not just to run your own books.

If you do need to register, the fee is tiered by staff numbers and turnover. A business with 10 or fewer staff and turnover under £632,000 pays Tier 1, currently £52 a year (£47 by direct debit). Between 10 and 250 staff, or turnover up to £36 million, moves you to Tier 2 at £78 a year. Almost every stove installation business reading this sits in Tier 1.

Skip it and the ICO can issue a fixed penalty, reported to run from £400 up toward £4,000 depending on the tier and whether there are aggravating factors like ignoring a warning letter. The ICO does run checks against companies house records and VAT registrations to spot businesses that should be registered but aren't, so "they'll never know" isn't a safe bet. The ICO's own self-assessment tool (on ico.org.uk) takes about five minutes and tells you definitively which tier, if any, applies to your setup.

What this actually covers day to day

Registering and paying the fee isn't the end of it, it's the entry ticket. UK GDPR also expects you to handle customer data sensibly once you're holding it, and most of that is just formalising things a careful installer already half does:

Only collect what you need for the job. A customer's name, address, contact details, and the technical details of their install are fine. There's no reason to be holding onto, say, a copy of their bank statement once a payment's cleared.

Keep it secure. A password-protected system that only you and your team can access is the baseline. A spreadsheet synced to a personal Google Drive with no password, or old job folders sitting in a shared family laptop, is the kind of thing that turns an honest mistake into a reportable breach.

Don't keep it forever "just in case." There's no single fixed retention period written into law for a trade business, but you need a reason for how long you keep records, and that reason usually comes from something else: HETAS recommends keeping compliance paperwork (certificates, flue test records) for the life of the installation in case of a warranty or insurance query, which in practice means years, sometimes a decade or more. Old enquiry details from someone who never booked a job, sitting in your system five years later with no commercial reason to still be there, is harder to justify.

Delete it properly when it's time. That means actually removing it from your system, not just moving it to an archive folder nobody looks at, if a customer asks you to.

What happens when something goes wrong

If customer data is lost, stolen, or exposed, for example a laptop with job records gets stolen from your van, or you send someone's quote and photos to the wrong email address, you need to work out fast whether it needs reporting.

The rule is 72 hours from when you discover the breach, not from when it happened, to report it to the ICO if it meets the threshold for reporting: broadly, if there's a risk to the people whose data it is. A single appointment reminder sent to the wrong customer, who deletes it and nothing comes of it, probably doesn't meet that bar. A stolen laptop holding years of customer addresses, phone numbers and photos of their homes almost certainly does.

Even when you decide a breach doesn't need reporting, you're still expected to keep a log of it: what happened, how many people were affected, a rough timeline, and what you did about it. That log is the thing an ICO investigator will ask to see if a customer complains later, and "we didn't think it was serious enough to write down" is a much weaker position than having a one-paragraph note on file.

The bit that actually matters for a CRM-based business

If you're already running job tracking through software rather than paper, you're in a better starting position than you might think, because a proper system gives you most of the control GDPR expects almost by default: one login, one place data lives, an audit trail of who looked at what, and the ability to pull up or delete a specific customer's record on request rather than hunting through years of paper files or old email threads.

What it doesn't do automatically is the registration itself, or the judgement calls around retention and breach reporting, those are still yours to make. But the actual mechanics of holding data securely and being able to produce or delete it when asked are exactly what a job-tracking system like BurnerCRM is built to handle, rather than something bolted on as an afterthought to a spreadsheet full of customer addresses and HETAS references that's been growing since 2019.

If you haven't run the ICO's self-assessment yet, it's worth five minutes before your next quote goes out, not after a customer asks where their data's been sitting for the last three years.