UK GDPR Compliance FAQ

Describe the processing in concrete terms: who collects or receives which personal data, about whom, for what purpose, in which systems and countries, for how long, and with which recipients. Then classify each party as controller, joint controller, or processor for that activity. The role determines who selects the lawful basis, gives privacy information, handles rights, completes DPIAs, reports breaches, and controls processors.

Choose an Article 6 lawful basis before processing and make sure it fits the actual purpose. Consent is only one basis. If special-category data is used, identify both an Article 6 basis and an Article 9 condition, plus any Data Protection Act 2018 Schedule 1 condition and policy document that applies. Criminal-conviction and offence data has its own Article 10 and DPA 2018 requirements.

Screen for a DPIA before likely high-risk processing. Article 35 always captures specified forms of significant automated evaluation, large-scale sensitive-data processing, and large-scale public monitoring; ICO guidance identifies additional high-risk operations and indicators. Consult the ICO before processing if high residual risk cannot be reduced.

Check whether a DPO is mandatory for a public authority or body, or because core activities involve large-scale regular and systematic monitoring or large-scale special-category or criminal-offence data. Whether or not a DPO is required, assign sufficient expertise, authority, resources, and management ownership.

Give Article 13 privacy information when personal data is obtained from the person. For data from another source, Article 14 generally requires information within a reasonable period and no later than one month, but earlier deadlines apply at the first communication with the person or before the first disclosure. Check the stated exceptions rather than treating one month as universal.

Respond to rights requests without undue delay and within the Article 12A period. The one-month clock starts at the latest of receipt, receipt of reasonably requested identity information, or payment of a permitted fee. It can be extended by two months for complexity or number; only an access request has the separate clarification pause. For significant decisions without meaningful human involvement, current Articles 22A to 22C require information, representation, human-intervention, and contest safeguards and impose extra restrictions for special-category processing and recognised legitimate interests.

For a personal data breach, record when the controller became aware and assess risk to people. Notify the ICO unless the breach is unlikely to result in risk, without undue delay and, where feasible, within 72 hours. Tell affected people without undue delay when high risk is likely and no Article 34 exception applies. Document every personal data breach.

For an international disclosure or remote access, first decide whether it is a restricted transfer. Check current UK adequacy regulations. If none covers the transfer, use an Article 46 safeguard and complete the data protection test, which the ICO still calls a TRA, or rely on a specific Article 49 exception where its conditions are met.