Classify each processing activity from the parties' actual decisions. Contract labels help describe the arrangement but do not decide UK GDPR status.
Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.
Roles are assigned for a particular processing activity, not permanently to an organisation. A determines why and the of processing; determine those matters together; a handles personal data on documented instructions for a controller. The same company can be a controller for one use and a processor for another.
Define one processing activity at a time, then ask who decides why it happens and the : which personal data and people are in scope, who receives the data, how long it is kept, and the main processing operations. A party that makes those decisions is a . Parties that make them together are . A party that processes only on another controller's documented instructions is a .
The same organisation can hold different roles for different activities. For example, a hosting provider may be a for customer content but a for its own workforce administration or independently determined fraud-prevention processing. Split those activities instead of assigning one label to the entire commercial relationship.
Sources (4)
ICO guidance supports controller and processor status decisions by defining each role and explaining role-specific UK GDPR responsibilities.
Official ICO template for documenting controller processing activities after role classification.
Official ICO template for documenting processor processing activities after role classification.
Binding definitions and duties for controllers, joint controllers, processors, subprocessors, and people acting under a controller's or processor's authority.
The business owner should describe the service and decisions; privacy or legal should challenge the classification; procurement should align the contract; and engineering or operations should confirm the data flow and instruction controls. Record the conclusion per processing purpose, not only per vendor.
Evidence should include the data-flow map, decision-rights matrix, service description, instructions, Article 28 clause map where applicable, subprocessor list, joint- arrangement where applicable, privacy-notice treatment, and review triggers.
Sources (3)
Official ICO template for controller Article 30 records.
Official ICO template for processor Article 30 records.
ICO guidance supports the evidence test by focusing on who decides purpose, data collection, retention, disclosures, and rights handling.
A can choose non-essential technical details while remaining a processor, but independent decisions about the purpose or point to status. Commercial influence, access to data, or drafting the contract does not by itself settle the role.
Joint participation does not always mean joint control. The parties must jointly determine purposes and means for the same processing. Sequential or connected processing can still involve separate controllers when each party decides its own purpose and means.
Classify each distinct use. A cloud provider may be a when it stores customer records on instructions and an independent when it uses account contacts for its own billing or fraud controls. The result follows the actual decision rights and processing, not the product label.
Sources (4)
ICO guidance supports controller and processor status decisions by defining each role and explaining role-specific UK GDPR responsibilities.
Official ICO template for controller Article 30 records; it does not determine role classification.
Official ICO template for processor Article 30 records; it does not determine role classification.
ICO guidance supports the evidence test by focusing on who decides purpose, data collection, retention, disclosures, and rights handling.
For a -to- activity, Article 28 requires a binding contract or other legal act describing the processing and setting the listed instruction, confidentiality, security, subprocessor, assistance, deletion or return, and audit duties. Controllers must use processors that provide sufficient guarantees.
For joint control, document the transparent allocation of responsibilities and provide the essence to people. For separate controllers, document the disclosure purpose, lawful basis, transparency, security, rights handling, and any transfer restriction without misusing an Article 28 contract.
A general written subprocessor authorisation must require the to tell the about intended additions or replacements so the controller can object. A processor must also tell the controller if, in its opinion, an instruction infringes the UK GDPR or other applicable UK data-protection law.
Sources (4)
ICO guidance supports controller and processor status decisions by defining each role and explaining role-specific UK GDPR responsibilities.
Official ICO template for recording controller processing activities.
Official ICO template for recording processor processing activities.
Binding source for joint-controller arrangements, processor guarantees and clauses, subprocessor authorisation and liability, unlawful-instruction warnings, and processing under authority.
Record each controller, joint-controller, and processor decision with its owner, evidence, agreement, and review trigger.
Create scoped role questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.