Start with the processing activity, the organisation's role, the people and data involved, and the decision or duty that has been triggered.
Read the with the Data Protection Act 2018. PECR, sector rules, contracts, and the EU GDPR may impose separate duties on the same activity.
The governs most general processing of personal data in the UK and applies alongside the Data Protection Act 2018. It can also apply to an organisation outside the UK under Article 3. The Data (Use and Access) Act 2025 amendments are now in force, including changes to lawful bases, rights timing, automated decisions, transfers, cookies, and complaints. This hub gives the decision sequence and standalone answers a product, legal, privacy, security, procurement, or compliance team needs.
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.
Describe the processing in concrete terms: who collects or receives which personal data, about whom, for what purpose, in which systems and countries, for how long, and with which recipients. Then classify each party as controller, joint controller, or processor for that activity. The role determines who selects the , gives privacy information, handles rights, completes DPIAs, reports breaches, and controls processors.
Choose an Article 6 before processing and make sure it fits the actual purpose. Consent is only one basis. If is used, identify both an Article 6 basis and an Article 9 condition, plus any Data Protection Act 2018 Schedule 1 condition and policy document that applies. Criminal-conviction and offence data has its own Article 10 and DPA 2018 requirements.
Sources (2)
Binding source for territorial scope, principles, lawful bases, special-category processing, roles, rights, security, accountability, and transfers.
Binding companion legislation for UK definitions, special-category and criminal-offence conditions, exemptions, the ICO, enforcement, and separate processing regimes.
Screen for a before likely high-risk processing. Article 35 always captures specified forms of significant automated evaluation, large-scale sensitive-data processing, and large-scale public monitoring; ICO guidance identifies additional high-risk operations and indicators. Consult the ICO before processing if high residual risk cannot be reduced.
Check whether a is mandatory for a public authority or body, or because core activities involve large-scale regular and systematic monitoring or large-scale special-category or criminal-offence data. Whether or not a DPO is required, assign sufficient expertise, authority, resources, and management ownership.
Sources (4)
ICO guidance on accountability, records, contracts, DPIAs, DPOs, security, breach records, policies, and ongoing review.
ICO guidance on risk-based technical and organisational security under UK GDPR Article 32.
Current ICO summary of the complaint process and 30-day acknowledgement requirement, and confirmation that all DUAA data-protection provisions are in force.
Current regulator guidance on complaint intake, acknowledgement, investigation, progress, outcome, and records.
Give Article 13 privacy information when personal data is obtained from the person. For data from another source, Article 14 generally requires information within a reasonable period and no later than one month, but earlier deadlines apply at the first communication with the person or before the first disclosure. Check the stated exceptions rather than treating one month as universal.
Respond to rights requests without undue delay and within the Article 12A period. The one-month clock starts at the latest of receipt, receipt of reasonably requested identity information, or payment of a permitted fee. It can be extended by two months for complexity or number; only an access request has the separate clarification pause. For significant decisions without meaningful human involvement, current Articles 22A to 22C require information, representation, human-intervention, and contest safeguards and impose extra restrictions for special-category processing and recognised legitimate interests.
Sources (2)
ICO guidance on transparency and the access, rectification, erasure, restriction, portability, objection, and automated-decision rights.
Sets age 13 for UK GDPR Article 8 consent to an information society service offered directly to a child.
Capture the processing facts, legal trigger, owner, required action, evidence, approval, and review date before implementation.
Turn UK GDPR questions into scoped evidence requests, owners, and actions.
Use Research Copilot to answer a follow-up question against legislation and ICO material.
Review the processing scope, decisions, evidence, and next actions with Sorena.
For a , record when the controller became aware and assess risk to people. Notify the ICO unless the breach is unlikely to result in risk, without undue delay and, where feasible, within 72 hours. Tell affected people without undue delay when high risk is likely and no Article 34 exception applies. Document every personal data breach.
For an international disclosure or remote access, first decide whether it is a . Check current UK adequacy regulations. If none covers the transfer, use an Article 46 safeguard and complete the data protection test, which the ICO still calls a TRA, or rely on a specific Article 49 exception where its conditions are met.
Sources (2)
Current ICO guidance on breach recognition, risk, reporting, communication, processor escalation, and records.
Current ICO guidance hub for restricted transfers, adequacy, safeguards, the data protection test, and exceptions.
Choose the Article 6 basis that fits the specific purpose and facts; there is no universal first choice. Document why the processing meets every condition of that basis before it starts. If special-category or criminal-offence data is involved, add the separate and Data Protection Act 2018 condition.
A controller must notify the ICO without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to result in risk to people's rights and freedoms. Give available information in phases if necessary, explain delay beyond 72 hours, assess the separate high-risk test for telling people, and document every breach.
Give it within a reasonable period and no later than one month after obtaining the data, taking account of the circumstances. If you communicate with the person sooner, give it by the first communication; if you disclose the data sooner, give it by the first disclosure. Article 14 contains exceptions that require a fact-specific assessment.
No. Age 13 is the UK threshold in the Article 8 consent rule for an information society service offered directly to a child. The Children's Code addresses relevant online services likely to be accessed by children under 18. A other than consent does not remove the code's design and best-interests analysis.
It can. Article 3 applies the to processing in the context of a UK establishment and can also reach an organisation outside the UK when it offers goods or services to people in the UK or monitors their behaviour in the UK. Mere website accessibility is not enough by itself. An overseas organisation should record the territorial facts, check whether a UK representative is required, and separately assess EU GDPR or other local law.
Under Article 12A, the one-month period begins at the latest of the date the controller receives the request, receives additional identity information reasonably requested under Article 12(6), or receives a permitted fee. A controller may extend by two further months where complexity or the number of requests makes that necessary, but it must notify the person within the first month and explain the delay. Clarification pauses the clock only for an access request and only where further information is reasonably needed to identify the requested information or processing.
The tests are separate. Complete a before processing likely to result in high risk to people's rights and freedoms. Appoint a only when Article 37's public-authority, large-scale monitoring, or large-scale sensitive-data core-activity test applies, although an organisation may appoint one voluntarily. A project can require a DPIA when the organisation has no DPO, and a DPO appointment does not make the DPO responsible for the controller's processing decision.
No. Classify the supplier for each processing activity by who actually determines the purpose and essential means. A supplier acting only on documented customer instructions is a processor; one deciding its own purpose and essential means is a controller for that use; parties deciding them together may be joint controllers. Align the agreement with that factual result and reopen it when product features, analytics, fraud controls, or data uses change.
Some do and some do not. The statistical-purposes exception can cover storage or access used solely to collect aggregate statistics about use of the operator's service or website with a view to improving it, provided users receive clear information and a simple, free way to object. It does not cover individual tracking, profiling, advertising measurement, cross-service monitoring, or a provider reusing data for its own purposes. Obtain valid consent before any non-exempt storage or access begins.
Give people a way to make a data protection complaint. A form, email address, phone line, portal, chat, or in-person route can support the process, but people do not have to use the preferred channel and the organisation must accept complaints received another way. Acknowledge receipt within 30 days, make appropriate enquiries, keep the person informed, and tell them the outcome without undue delay. Handle any rights request in the same message under its separate statutory clock.
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.