Gdpr

[HongKongphooey]

We are a small Electrical Contractors, Ltd company, and only employ 3 people, 4 if you include the Director. The only information we keep on our customers is names and addresses which is held on computer in the form of invoices that have previously been sent out. Does this info have to be encrypted? or just accessable by password? Do we have to write to customers to ask their permission to keep there name and address on computer?
So confused, I have looked it up on various websites and it doesn't answer these questions.
Is there anything else we have to do before 25/5/2018
Any help appreciated
Thanks