I'm amazed how many small businesses in the UK are unaware that the Data Protection Act requires them to register with the Information Commissioner even if the only personal data they hold is 'public domain', for example name, phone number and email. You are only exempt if you trade solely business to business (B2B), and even then if any contacts are sole traders or partnerships you need to register. For tier 1 organisations it can be done online in 30 minutes and costs only £35.