Cybersecurity Policy Report, U.K. Privacy Office Releases Cybersecurity Guidance for Small Businesses, (Sep 18, 2025)
By Tony Foley
The United Kingdom’s Information Commissioner’s Office (ICO) published guidance yesterday providing cybersecurity recommendations for small businesses to help them establish appropriate security measures to protect personal information.
Businesses experienced 7.7 million cyber crimes over the past year, and most small businesses hold personal information and conduct business digitally, making cybersecurity a priority, the ICO explained in a news release
“Cyberattacks have been hitting the headlines again recently, serving as a timely reminder for all businesses to check their own security measures,” said Ian Hulme, the ICO’s executive director–regulatory supervision. “While cyberattacks can be very sophisticated, we find that many organisations are still neglecting the very foundations of cyber security. As the data protection regulator, we want to support organisations to get this right, and these simple steps will help to protect both your customers and your business.”
The guidance offers several practical steps that businesses and their staff can take to improve their data security and resilience, including the following:
Back up data, and if using an external storage device, keep it somewhere outside the company’s main workplace;
Using strong passwords and multifactor authentication;
Be wary of suspicious e-mails;
Install antivirus and malware protection;
Protect devices when unattended and ensure secure WiFi connections;
Limit access to information to those who need it and take care when sharing screens or sending e-mails to multiple people;
Don’t keep data longer than needed; and
Securely dispose of old IT equipment and records.
ICO’s guidance concludes by noting that organizations suffering a breach as the result of a cyber attack should report the incident to the ICO within 72 hours.
News: InternationalLegislation DataSecurity