Answer the UK GDPR questions that usually block implementation decisions.
Use these answers to align legal, engineering, procurement, and support teams before work starts.
Structured answer sets in this page tree.
Cited legal and guidance references.
The same UK GDPR questions come up repeatedly in implementation work. Treat the answers as decision rules and link them to documented evidence.
Common questions include whether a non UK company is in scope, whether a vendor is a processor or a controller, and whether a small company must still keep Article 30 records.
Most practical disputes are about whether adequacy is enough, when to use the IDTA instead of the Addendum, whether a request can be extended, and what starts the 72 hour breach clock.
If children are likely to use the service, the question is not whether the product is intended for children but whether the evidence shows that children are likely users. On enforcement, the ICO looks at whether the organisation can prove what it did and why.
Research Copilot can take UK GDPR FAQ from cited answers to recurring questions on this topic to a reusable workflow inside Sorena. Teams working on UK GDPR can keep owners, evidence, and next steps aligned without copying this guide into separate documents.