We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKCompliance

UK GDPR Compliance

This implementation guide helps translate the UK GDPR duties into owned controls, evidence, review checkpoints, and escalation paths.

Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 27, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
11

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 27, 2026
Overview

The , supplemented by the Data Protection Act 2018, governs most general processing of in the UK and can also reach an organisation outside the UK under Article 3. It has applied in its UK form since 1 January 2021, and the Data (Use and Access) Act 2025 amendments are now in force. This page maps the main duties to the decisions, owners, deadlines, and evidence a compliance programme needs.

Section 1

How should privacy, product, and data teams structure a UK GDPR Compliance plan?

Build compliance around processing activities, not policies alone. For each activity, record scope and role, purpose and lawful basis, or 10 condition, notice, data fields and recipients, retention, security, processor terms, rights handling, decision, transfer route, breach path, owner, and change trigger.

Accountability means being able to demonstrate why the activity is lawful, fair, transparent, necessary, proportionate, accurate, time-limited, and secure. A completed checklist is useful evidence only when it links to the actual system, decision, contract, test, approval, and operating record.

  • Maintain an inventory that connects each purpose, system, data category, person, recipient, retention rule, and transfer to an accountable owner.
  • Record the Article 6 basis before processing starts and any separate condition or Article 10 authority. Necessity must be tested, not assumed.
  • Give Articles 13 or 14 information in clear language and keep it aligned with the live activity and children's needs where relevant.
  • Operate rights requests, security, breach assessment, DPIAs, processor oversight, and transfer controls as tested workflows with case records.
  • Give people a way to make data protection complaints, accept complaints received through other channels, acknowledge receipt within 30 days, make appropriate enquiries, and communicate the outcome without undue delay.
  • Review controls after a purpose, data, model, supplier, market, user group, or legal change; a policy review alone does not test the live processing.
Sources for this answer
Consolidated UK GDPR Articles 5-6, 9-10, 12-14 and 24-36
Binding source for principles, lawful processing, transparency, accountability, design, role arrangements, records, security, breaches, and DPIAs.
ICO guide to accountability and governance
Regulator guidance on demonstrating compliance through measures, documentation, design controls, DPIAs, DPOs, and contracts.
ICO guide to data security
Regulator guidance on selecting and maintaining appropriate technical and organisational security measures.
ICO - Data (Use and Access) Act 2025 changes for organisations
Current ICO summary confirming that the data-protection amendments are in force and explaining the complaints-channel, 30-day acknowledgement, rights, cookie, automated-decision, and transfer changes.
ICO - How to deal with data protection complaints
Current regulator guidance on recognising complaints, providing a complaint route, acknowledging within 30 days, making appropriate enquiries, responding without undue delay, and keeping records.
Section 2

Who should own the UK GDPR compliance, and what evidence should prove the decision?

Senior management remains responsible for the compliance framework. Processing owners make and maintain activity-level decisions; privacy or legal reviews legal interpretation; security owns technical and organisational safeguards; procurement manages processor terms and supplier evidence; service teams operate rights and incident channels. A DPO, where required, advises and monitors but does not take over the controller's responsibility.

Evidence should include the record of processing, role map, lawful-basis and necessity analysis, or 10 condition, notice, retention decision, processor or joint-controller terms, security tests, , rights cases, complaint register, breach log, transfer route, training, review results, and remediation.

  • Name one accountable owner and one reviewer for the Compliance workflow.
  • Keep source screenshots or source links, decision notes, implementation tickets, and approval records together.
  • Use dated evidence for deadlines, notices, risk assessments, contracts, user journeys, and regulator-facing records.
  • Review the evidence after product changes, new markets, new vendors, enforcement updates, or material changes in the source text.
Sources for this answer
Consolidated UK GDPR Articles 24, 30, 35 and 37-39
Binding source for controller accountability, records, DPIAs, and the DPO's advisory and monitoring tasks.
ICO guide to accountability and governance
Regulator guidance on governance roles, evidence, DPO independence, documentation, and contracts.
Section 3

Which edge cases should teams check before relying on a UK GDPR compliance decision?

At a boundary, identify which instrument supplies the rule: for general processing, the Data Protection Act 2018 for UK conditions, exemptions, and separate regimes, PECR for communications and device access, and EU GDPR where its territorial scope independently applies. Transfer instruments address Chapter V only.

The does not cover genuinely anonymous information or processing by a person in a purely personal or household activity with no professional or commercial connection. Part 3 of the Data Protection Act 2018 governs competent-authority law-enforcement processing and Part 4 governs intelligence-service processing. Pseudonymised data remains when it can be attributed to a person using additional information.

Review this section before approving a new processing purpose, vendor, transfer, profiling flow, DSAR workflow, breach process, or child-facing product change.

  • Check whether the rule changes for minors, consumers, business users, public-sector bodies, regulated sectors, high-risk services, or cross-border transfers.
  • Separate binding law, regulator guidance, consultation material, standards, and enforcement commentary in the evidence record.
  • Do not rely on a previous answer if the data categories, user interface, vendor role, or contractual flow changed.
  • Track unresolved assumptions in an open-questions section and route legal interpretation points for review.
Sources for this answer
Consolidated UK GDPR
Binding general-processing rules and territorial-scope provisions.
Data Protection Act 2018
Binding source for UK conditions, exemptions, enforcement, and separate processing regimes.
Privacy and Electronic Communications Regulations 2003
Binding separate rules for electronic communications, marketing, and storing or accessing information on terminal equipment.
Section 4

How should teams put UK GDPR controls into operation?

Use one control register that links each statutory duty to the processing activities it affects, the responsible owner, the operating procedure, the evidence location, exceptions, last test, and next trigger-based review. Sample completed cases and system behaviour, not only documents.

Record gaps as remediation with an owner and due date. Build statutory clocks into the workflow: give Article 14 information within its applicable window, answer rights requests within the Article 12A period, notify the ICO of a reportable breach without undue delay and where feasible within 72 hours, and acknowledge a data protection complaint within 30 days. If proposed processing is likely to create high risk, complete the before processing. If high residual risk remains after mitigation, assess whether Article 36 prior consultation is required before launch.

  • Use intake questions that identify the purpose, role, data, people, systems, recipients, countries, technology, risk, and intended start date.
  • Map each answer to the applicable duty or exception, required action, evidence field, owner, reviewer, due date, and reassessment event.
  • Link every control to the live system, notice, contract, case record, or test that proves it operates.
  • Update the workflow when the consolidated law or ICO guidance changes, or when case sampling exposes a recurring gap or exception.
Sources for this answer
Consolidated UK GDPR Articles 24, 25, 35 and 36
Binding source for accountable measures, review and updating, design controls, DPIAs, and prior consultation.
ICO guide to accountability and governance
Regulator guidance for turning accountability into operating controls and evidence.
UK ICO data protection audit framework
Operational implementation support for the UK GDPR compliance.
ICO - Data (Use and Access) Act 2025 changes for organisations
Current regulator summary for the complaint acknowledgement deadline and the amended rights, automated-decision, cookie, and transfer rules.
Recommended next step

Turn UK GDPR Compliance into assigned work

Assign each live processing activity an owner, legal decision record, operating control, statutory clock, evidence location, and change-triggered review.

Assessment workflow
Open Assessment Autopilot for UK GDPR

Turn Compliance into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review UK GDPR source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next Compliance actions with Sorena.

Explore next step
Primary sources

References and citations

Consolidated UK GDPR
legislation.gov.uk
Referenced sections
  • Binding general-processing rules and territorial-scope provisions.
Data Protection Act 2018
legislation.gov.uk
Referenced sections
  • Binding source for UK conditions, exemptions, enforcement, and separate processing regimes.
ICO - How to deal with data protection complaints
ico.org.uk
Referenced sections
  • Current regulator guidance on recognising complaints, providing a complaint route, acknowledging within 30 days, making appropriate enquiries, responding without undue delay, and keeping records.
ICO guide to data security
ico.org.uk
Referenced sections
  • Regulator guidance on selecting and maintaining appropriate technical and organisational security measures.
Related guides

Explore more topics

How do you choose a lawful basis under the UK GDPR?
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
UK Children's Code: Scope and 15 Standards
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
UK GDPR 72-hour Breach Reporting Guide
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
UK GDPR 72-Hour Breach Reporting: Decision Guide
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
UK GDPR Adequacy Guide
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
UK GDPR Adequacy: When Can You Rely on It?
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
UK GDPR AI and Automated Decisions Guide
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
UK GDPR AI and Automated Decisions: Articles 22A-22D
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
UK GDPR Applicability Test Guide
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
UK GDPR Article 30 Records Guide
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
UK GDPR Article 30 Records: What to Document
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
UK GDPR Breach Notification Guide
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
UK GDPR Breach Workflow Guide
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
UK GDPR Children and Age Appropriate Design Guide
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
UK GDPR Children's Code Guide
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
UK GDPR Compliance Checklist
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
UK GDPR Compliance FAQ: Duties, Rights, and Decisions
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
UK GDPR Controller and Processor Status Guide
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
UK GDPR Controller or Processor: How to Decide
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
UK GDPR Data Subject Rights Guide
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
UK GDPR Deadlines and Compliance Calendar Guide
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
UK GDPR DPIA Workflow Guide
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
UK GDPR DPIA: When It Is Required and What to Record
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
UK GDPR DPIAs and DPOs Guide
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
UK GDPR DPO: When Appointment Is Mandatory
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
UK GDPR DSAR Workflow Guide
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
UK GDPR IDTA Addendum and Transfer Risk Assessment Guide
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
UK GDPR Lawful Bases Guide
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR PECR Cookies Guide
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
UK GDPR Penalties and Fines: Maximums and ICO Factors
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
UK GDPR Requirements Guide
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
UK GDPR Transfer Workflow Guide
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
UK GDPR Transfers, IDTA, and UK Addendum Guide
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
UK GDPR vs Data Protection Act 2018: How They Work Together
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
UK GDPR vs EU GDPR: Scope, Regulators and Transfers
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
UK IDTA vs EU SCCs: Which Transfer Contract to Use
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
UK IDTA, Addendum, and Transfer Risk Assessment Guide
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
UK vs EU GDPR Differences After the 2025 UK Reforms
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
UK vs EU GDPR Operations: Regulators, Breaches and Transfers
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
When do PECR cookie rules require consent?
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.