Yes, GDPR applies to *anyone processing personal data. So, if you're a small business, charity or club and hold people's names and contact details or other personal information on members, customers or donors, you must adhere to UK data protection law. You may also need to pay a data protection fee* (you can check this by going to https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/). * The only exception is when you process someone's data as part of your everyday personal or domestic activities (e.g., in a non-professional, non-commercial capacity such as personal correspondence or social networking).