TRW & Co · Data protection
UK GDPR Compliance Checklist for Businesses
UK GDPR compliance means being able to prove, with documents, that you process personal data lawfully, transparently and securely. This checklist covers lawful bases, privacy notices, records of processing, DPIAs, processor contracts, international transfers, security, breaches, rights requests and the new complaints duty, reflecting the Data (Use and Access) Act 2025 changes in force as of October 2026.
Key pointThe accountability principle reverses the usual burden: if you cannot produce the record, assessment or contract when asked, regulators and claimants will treat the compliance as missing.
At a glance
Maximum fines
The higher maximum penalty is £17.5 million or 4% of annual worldwide turnover, whichever is higher; the standard maximum is £8.7 million or 2%.
Seven lawful bases
Since February 2026 the UK GDPR has a seventh lawful basis, recognised legitimate interests, limited to purposes such as crime prevention, emergencies and safeguarding.
72-hour breach reporting
Reportable personal data breaches must be notified to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of them.
Complaints duty
Since 19 June 2026 controllers must facilitate data protection complaints, acknowledge them within 30 days and respond without undue delay.
Processor contracts
Article 28 requires a written contract with every processor covering instructions, security, sub-processors, assistance, deletion and audit rights.
Swipe or scroll →
The short answer: what UK GDPR compliance requires
UK GDPR compliance means being able to show, with documents, that your organisation processes personal data lawfully, fairly and transparently, for specified purposes, using no more data than it needs, keeping it accurate, secure and no longer than necessary. The "show" is the hard part: the accountability principle puts the burden on the organisation, not the regulator, to prove compliance.
In practice, that comes down to a manageable set of building blocks: a map of your data, a lawful basis for each purpose, clear privacy notices, records of processing, risk assessments for high-risk processing, proper contracts with processors, safeguards for international transfers, appropriate security, and working procedures for breaches, rights requests and complaints. This checklist works through each, reflecting the changes made by the Data (Use and Access) Act 2025, which are largely in force as of October 2026.
The legal framework
The UK GDPR is the retained version of the EU GDPR, as amended by UK law. It is read together with the Data Protection Act 2018, which adds exemptions, conditions for special category and criminal offence data, and the regulator's enforcement powers. Electronic marketing and cookies are governed separately by the Privacy and Electronic Communications Regulations 2003 (PECR).
The Data (Use and Access) Act 2025 amended all three. The main changes took effect on 5 February 2026, a complaints-handling duty followed on 19 June 2026, and the regulator became the Information Commission on 30 September 2026, still known as the ICO. Our guide to the Data (Use and Access) Act covers those reforms in detail.
Penalties are significant. Under section 157 of the Data Protection Act 2018, the higher maximum is £17.5 million or 4% of total annual worldwide turnover, whichever is higher; the standard maximum is £8.7 million or 2%. Regulators also use reprimands, enforcement notices and audits, and individuals can claim compensation.
The UK GDPR compliance checklist at a glance
| Area | What the law requires | Evidence to hold |
|---|---|---|
| Data mapping | Know what personal data you hold, where it comes from and where it goes | Data inventory and data-flow maps |
| Lawful basis | A lawful basis for every purpose, plus a condition for special category data | Lawful basis register; legitimate interests assessments |
| Transparency | Clear privacy information at the point of collection | Privacy notices, version history |
| Records | Records of processing activities for most organisations | Article 30 record |
| Risk | Data protection impact assessments for high-risk processing | DPIAs, sign-off and review dates |
| Processors | Written contracts with mandatory terms | Data processing agreements, due diligence |
| Transfers | Safeguards for transfers outside the UK | Transfer mechanisms and risk assessments |
| Security and breaches | Appropriate technical and organisational measures; 72-hour reporting | Security policies, breach log |
| Rights and complaints | Respond to requests on time; facilitate and answer complaints | Request and complaint logs, templates |
Lawful basis, special category data and transparency
Every purpose needs a lawful basis under Article 6: consent, contract, legal obligation, vital interests, public task, legitimate interests or, since February 2026, a recognised legitimate interest for a short list of purposes such as crime prevention and safeguarding. Choose the basis before processing starts and record why; switching later is hard to justify.
Legitimate interests is the most flexible basis but requires a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests. The Act now confirms that direct marketing, intra-group administrative transfers and network security can be legitimate interests, but the balancing test still applies. Consent should be reserved for cases where people have a genuine choice, which usually rules it out for employee data.
Health, biometric, ethnicity and other special category data need an additional condition, often from Schedule 1 to the Data Protection Act 2018, and many of those conditions require an "appropriate policy document". Criminal offence data has similar rules, which matters for background checks.
Privacy notices must tell people, in clear language, who you are, what you collect, why, on what basis, who receives it, how long you keep it, whether it leaves the UK, their rights, and how to complain, including to you as controller under the new complaints duty.
Individuals' rights and complaints
Individuals can ask for access to their data, rectification, erasure, restriction, portability, and can object to processing, including an absolute right to object to direct marketing. Most requests must be answered within one month, extendable by two further months for complex or numerous requests. Since February 2026, the clock starts only once any identity information or permitted fee is received, and pauses while you wait for clarification you reasonably need. Our guide to the subject access request process covers the most common right in detail.
Since 19 June 2026, controllers must also facilitate complaints about data protection, for example with an electronic complaint form, acknowledge each complaint within 30 days and respond without undue delay. Log every request and complaint, with dates and outcomes, so that you can demonstrate compliance if the regulator becomes involved.
Automated decisions, AI and children's data
If you use AI or other automated tools to make decisions with legal or similarly significant effects, the new rules in Articles 22A to 22D require safeguards, including a route to human intervention and the ability to contest the outcome. Stricter limits apply where special category data is involved. Online services likely to be accessed by children should also follow the ICO's Age Appropriate Design Code and the requirement, added by the 2025 Act, to take account of children's higher protection needs when designing services.
Records of processing and DPIAs
Most organisations must keep a record of processing activities under Article 30. There is a limited exemption for organisations with fewer than 250 employees, but it does not apply where processing is more than occasional, is likely to result in risk, or involves special category or criminal offence data, so most businesses with staff or customer databases need a record anyway.
A data protection impact assessment is mandatory where processing is likely to result in a high risk to individuals: for example, large-scale monitoring, profiling with significant effects, extensive use of special category data, or new technologies such as AI. The DPIA should describe the processing, assess necessity and proportionality, identify risks and record the mitigations. If high risk remains, the regulator must be consulted before processing starts.
Many organisations must also pay an annual data protection fee to the regulator under the Data Protection (Charges and Information) Regulations 2018, with the tier depending on size and turnover. Check whether you need to pay and keep the registration current.
UK GDPR compliance is judged on what you can produce when the regulator or a claimant asks, not on what your policies say you intend to do.
Processors, international transfers and security
Processor contracts
Where a supplier processes personal data on your behalf (payroll, cloud hosting, CRM, outsourced customer service), Article 28 requires a written contract with prescribed terms: processing only on instructions, confidentiality, security, sub-processor controls, assistance with rights requests and breaches, deletion or return at the end, and audit rights. Carry out due diligence before appointment and keep it under review. See our guides to SaaS agreements and outsourcing contracts.
International transfers
Transfers outside the UK require either UK adequacy regulations for the destination or an appropriate safeguard, usually the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment. Since February 2026, the test is whether the protection in the destination is not materially lower than in the UK. Our guide to international data transfers explains the mechanics.
Security and breach response
Article 32 requires security appropriate to the risk, which in practice means access controls, encryption, patching, multi-factor authentication, supplier security and staff training, tested regularly. Under Article 33, reportable breaches must be notified to the regulator without undue delay and, where feasible, within 72 hours of becoming aware. Every breach, reportable or not, must be logged. Our data breach reporting guide sets out the response plan.
Building a UK GDPR compliance programme
- Assign ownership. Appoint a data protection lead or, where required, a data protection officer (mandatory for public authorities and for organisations whose core activities involve large-scale monitoring or special category data), with board reporting.
- Map the data. Inventory systems, data categories, sources, recipients, retention periods and transfers.
- Fix the lawful basis. Record a basis per purpose, complete legitimate interests assessments and identify special category conditions and appropriate policy documents.
- Update notices and records. Refresh privacy notices, the Article 30 record and the cookie banner, reflecting the 2025 Act changes.
- Assess risk. Run DPIAs on high-risk processing, especially AI, monitoring and new products.
- Paper the supply chain. Put Article 28 terms and transfer mechanisms in place with every processor.
- Operationalise rights, complaints and breaches. Adopt procedures with templates, time limits and logs, and test them.
- Train, audit and repeat. Train staff, audit annually and update after significant changes.
Retention is the most neglected item on most UK GDPR compliance plans. Data kept "just in case" increases the impact of every breach and the cost of every subject access request. A retention schedule that is actually applied, with automated deletion where possible, reduces risk more than another policy document.
Illustrative scenario: a scale-up preparing for investment
This scenario is illustrative only. A London software company with a fast-growing customer base is preparing for a funding round. The investors' due diligence questionnaire asks for its record of processing, DPIAs, processor contracts, transfer mechanisms and breach log.
The company has a privacy notice but little else. Its engineering team in another country accesses production data, its product uses customer data to train a machine-learning model, and several suppliers have no data processing terms. None of these is unusual, but together they become warranty and disclosure issues in the deal.
A focused programme over a few weeks maps the data, documents a lawful basis for model training with a legitimate interests assessment and DPIA, puts intra-group and supplier transfer agreements in place, and creates the missing records. The company can then give accurate warranties. Our technology team often runs this alongside legal due diligence.
Common mistakes and how to avoid them
Relying on consent for everything
Consent must be freely given, specific, informed and as easy to withdraw as to give. It is often the wrong basis for employment data, where the power imbalance undermines freedom of choice, and for processing you would continue even if consent were withdrawn. Using consent where another basis fits better creates obligations you cannot meet. Choose contract, legal obligation or legitimate interests where they genuinely apply, and record the reasoning.
Copy-and-paste privacy notices
Notices adapted from another organisation often describe processing that does not happen and omit processing that does, such as analytics, AI training or transfers to overseas group companies. Regulators and claimants compare notices with actual practice. Build the notice from your data map, and review it whenever you launch a new product or supplier.
Missing processor terms and transfer documents
Standard supplier terms frequently fall short of Article 28 or are silent on international transfers and sub-processors. Where a supplier hosts or accesses data outside the UK, you also need a transfer mechanism and assessment. Gaps here are among the most common findings in investor due diligence and regulator audits.
No tested breach or request procedure
The 72-hour breach window and the one-month request deadline leave no time to design a process from scratch. Organisations without tested procedures miss deadlines, over-disclose third-party data or fail to notify when they should. A short playbook, named decision-makers and a tabletop exercise each year make a material difference.
Treating UK and EU GDPR as identical
Since the 2025 Act, the regimes have diverged on lawful bases, automated decisions, cookies and transfers. Businesses targeting EU customers may also need an EU representative and must follow EU rules for that processing. Group policies should say which rules apply where.
Cross-border businesses
UK GDPR applies to organisations established in the UK and to some outside it that offer goods or services to, or monitor, people in the UK. Businesses headquartered in Bangladesh, the Gulf or Singapore that sell into the UK may therefore need a UK representative as well as UK-compliant documentation. Conversely, UK businesses with offshore teams need transfer safeguards for data accessed from abroad. Our data protection solicitors can review cross-border structures for UK GDPR compliance.
Your UK GDPR compliance checklist
- Data map and Article 30 record complete and current
- Lawful basis recorded for every purpose; legitimate interests assessments done
- Special category conditions and appropriate policy documents in place
- Privacy notices and cookie banner reflect actual processing and the 2025 Act
- DPIAs completed for high-risk processing, including AI
- Article 28 terms with every processor; transfer mechanisms and assessments in place
- Security measures tested; breach log and 72-hour playbook ready
- Subject access, rights and complaints procedures with logs and templates
- Retention schedule applied; data protection fee paid where required
- Training delivered and annual audit scheduled
To review your programme or prepare for an audit or transaction, contact our London office or email info@trw.co.
Frequently asked questions
01Does UK GDPR apply to small businesses?
Yes. UK GDPR applies to any organisation processing personal data, whatever its size, unless the processing is purely personal or household. Small organisations have some lighter obligations, for example a limited exemption from keeping records of processing where processing is occasional and low-risk, but the principles, lawful bases, transparency, security and individuals' rights apply in full. Many small businesses must also pay the annual data protection fee.
02Do we need a data protection officer?
A DPO is mandatory for public authorities and for organisations whose core activities involve large-scale, regular and systematic monitoring of individuals or large-scale processing of special category or criminal offence data. Other organisations can appoint one voluntarily or nominate a data protection lead. If you appoint a DPO, they must have independence, expert knowledge and direct reporting to senior management.
03What changed in UK GDPR in 2026?
The Data (Use and Access) Act 2025 brought in most of its changes on 5 February 2026: recognised legitimate interests, a new automated decision-making regime, statutory subject access time limits, cookie consent exemptions, a new transfer test and higher PECR fines. A duty to handle complaints applied from 19 June 2026, and the Information Commission replaced the Information Commissioner on 30 September 2026.
04When is a DPIA required?
A DPIA is required before processing that is likely to result in a high risk to individuals. Examples include systematic and extensive profiling with significant effects, large-scale processing of special category data, large-scale monitoring of public areas and many uses of new technology, including AI. The ICO publishes a list of processing that requires a DPIA. If the assessment shows a high risk that cannot be mitigated, you must consult the regulator first.
05How do we transfer personal data outside the UK lawfully?
Either the destination must be covered by UK adequacy regulations or you need an appropriate safeguard, most commonly the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment. Since February 2026 the test is whether protection in the destination is not materially lower than in the UK. Limited derogations exist for occasional transfers.
06What happens if we are not compliant?
The regulator can issue reprimands, enforcement notices and fines up to £17.5 million or 4% of worldwide turnover. It can also carry out audits and, since the 2025 Act, require interviews and technical reports. Individuals can claim compensation for damage, including distress. Non-compliance also surfaces in commercial due diligence, procurement questionnaires and customer audits, often with greater commercial impact than the regulatory risk.
Sources and official materials
- Data Protection Act 2018 — Exemptions, conditions and enforcement powers
- Data Protection Act 2018, section 157 — Maximum penalty amounts
- UK GDPR Article 6 — Lawful bases, including recognised legitimate interests
- UK GDPR Article 33 — Notifying a personal data breach to the regulator
- Data (Use and Access) Act 2025 — 2025 reforms to UK GDPR, DPA 2018 and PECR
- Privacy and Electronic Communications Regulations 2003 — Cookies and electronic marketing
- Information Commission (ICO) — Regulator guidance and data protection fee
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.