How to Prevent a Data Breach: Practical Steps for UK Businesses

The government's most recent Cyber Security Breaches Survey found that 43% of UK businesses identified a cyber breach or attack in the previous twelve months — and, importantly for anyone who assumes size is protection, that the figures for micro and small businesses were 42% and 46%. The encouraging part is that the causes are rarely sophisticated. The Information Commissioner's Office put it plainly when it published cyber advice for small businesses: attacks can be very sophisticated, but many organisations are still neglecting the very foundations. This guide covers those foundations, in the order that gets you the most protection soonest. For the compliance framing around all of it, see our complete PCI DSS compliance guide.

What actually causes breaches in small businesses?

Recent UK regulatory findings are remarkably repetitive, which is good news — a short list of failures accounts for most incidents. An account without multi-factor authentication, usually one that had been forgotten about. Administrative access far beyond what the job needed. Software years past the end of support. Vulnerability scanning that was bought and never run. An alert that fired correctly and sat unread. A member of staff who clicked something and did not feel able to say so.

Notice what is absent from that list: novel attacks, zero-day exploits and determined adversaries. Almost everything on it is a control that was either missing, misconfigured, or present but unused.

Start with what you hold

The cheapest data to protect is data you do not have. Before buying anything, find out what customer information your business actually stores, where it lives and why. Most small businesses are surprised, usually by a spreadsheet, an old booking system or a folder of emails nobody has looked at in years.

For card data specifically, the answer should almost always be that you hold none at all. If a process is generating card numbers on paper or in a system of yours, that process can usually be changed — and doing so often moves you to a simpler questionnaire as well as reducing your risk. Our guide to the card-present SAQ types explains how your payment setup drives your obligations.

The five controls that do most of the work

The Cyber Essentials scheme is built around five technical controls — firewalls, secure configuration, security update management, user access control and malware protection — and the ICO said in 2026 that it expects organisations using or storing personal data to have them in place. That is a useful benchmark precisely because it is short. Our comparison of Cyber Essentials and PCI DSS explains how the two relate, and where Cyber Essentials stops short of what PCI DSS needs.

Turn on multi-factor authentication

If you do only one thing, do this. It is the control whose absence appears in essentially every recent enforcement case, and it defeats the overwhelming majority of attacks that begin with a stolen or guessed password. Cover email first, then payment portals, website and hosting administration, remote access and cloud services. Then check for the accounts that get skipped — service accounts, supplier logins, and anything belonging to someone who has left. Our guide to passwords and MFA covers which methods are strongest and why forced password rotation is no longer recommended.

Patch what you have, replace what you cannot

Turn on automatic updates wherever possible, and treat fourteen days as the deadline for anything critical. The harder half is unsupported software: once a system stops receiving security updates, no patching schedule can help it, and it needs replacing rather than managing. Our guide to patching and vulnerability scans covers the deadlines in both standards and whether you need scanning at all.

Separate the payment environment

A flat network — where the till, the office laptops, the guest Wi-Fi and the smart devices all share one space — means a compromise anywhere is a compromise everywhere, and it pulls your entire estate into scope for compliance. Separating payment systems is usually achievable with equipment you already own. The two guides worth reading together here are network security controls under PCI DSS v4 and remote access and card terminals, since remote support is the most common route in.

One further point that is easy to miss: personal devices. A recent UK penalty followed an attacker compromising an unmanaged home computer belonging to a senior engineer, installing a keylogger and capturing credentials that opened the corporate environment. If a device can reach both the internet and anything sensitive, it needs to be managed, patched and protected like any other.

Do not forget the premises

Digital controls do not help against someone who can reach the terminal. Keep an inventory of your card devices with serial numbers, check them for tampering on a defined schedule, lock away anything on paper, and make sure staff know they are allowed to challenge an unexpected engineer. Our guide to physical security for card data covers the walk-round in detail.

Prepare the people

Phishing was by far the most common attack type in the most recent survey, experienced by 38% of all businesses, and it was named the most disruptive kind of incident by around seven in ten of those affected. That makes staff awareness a control rather than a formality. Three guides cover this ground: why phishing still works, training staff to spot card fraud, and why good staff bypass security rules — the last of which is the one most businesses need and least expect.

Make sure you would actually notice

Prevention is only half a strategy, because some attacks will succeed. The gap that turns an incident into a catastrophe is detection time: in one recent case attackers were present for roughly twenty-two months before anyone noticed. You do not need enterprise monitoring to close most of that gap. Make sure someone actually reads the alerts your existing tools already generate, check who has access to your systems every few months, and know what normal looks like well enough to notice when it is not.

Back up properly as well, and test that you can restore. Ransomware reaches only around 1% of UK businesses in a given year, but the average loss reported by small and mid-sized UK companies runs to hundreds of thousands of pounds. That combination — unlikely but potentially business-ending — is precisely the risk that backups exist to manage.

What order should you do this in?

• Turn on multi-factor authentication for email and payment accounts today. It is free, it takes an afternoon, and it removes the most common attack outright.
• List what data you hold and delete what you do not need, starting with anything containing card numbers.
• Turn on automatic updates everywhere and identify anything running unsupported software.
• Review who has access — staff, leavers, suppliers, service accounts — and remove what is not needed.
• Separate guest Wi-Fi and the payment environment from everything else.
• Check your backups restore, not just that they run.
• Brief the team on phishing and on reporting mistakes without blame.
• Write the one-page incident plan, then confirm your compliance position so the paperwork is in place before you need it.

Key takeaways

• Around four in ten UK businesses identified an attack last year, and micro and small businesses were not meaningfully safer.
• The causes are consistently mundane: missing multi-factor authentication, excess privilege, unsupported software and unread alerts.
• Holding less data is the cheapest control there is — and for card numbers the target should be none at all.
• Multi-factor authentication first, then patching, then access review, then segmentation. That order buys the most protection soonest.
• Assume something will get through: backups you have tested and an incident plan people have read are what make it survivable.

Most of this list costs nothing but attention. The compliance paperwork that proves you did it is where we come in: Fraud Defence First's fully managed PCI compliance service establishes what is in scope, completes the right questionnaire with you and files it with your acquirer — a flat £100 + VAT a year.