UK GDPR Requirements

Map the seven principles first, including accountability. Then attach Article 6 and any Article 9 or 10 condition, privacy information, rights, privacy by design and default, processor and joint-controller arrangements, records, security, breach readiness, DPIA or DPO triggers, and Chapter V transfer controls.

Reflect the current consolidated UK text, including recognised legitimate interests, amended request timing and access searches, Articles 22A-22D, the revised transfer route, PECR storage-and-access exceptions, and the data protection complaints process. Legislation is binding; ICO material explains the regulator's interpretation and expected practice. Recheck older guidance and templates where the law has changed.

Assign each requirement to the actor that can perform it. Controllers decide purposes and essential means and remain responsible for compliance; processors act on documented instructions and have direct duties including security, records, cooperation, and breach escalation. Joint controllers must allocate responsibilities transparently, although people may exercise rights against either controller.

Evidence should show both the legal decision and operation: the processing record, notice, contract, system setting, access review, deletion result, request case, complaint case, security test, DPIA, breach assessment, transfer record, approval, and remediation. The evidence set must match the activity rather than repeat every possible document.

At a boundary, identify which instrument supplies the rule: UK GDPR for general processing, the Data Protection Act 2018 for UK conditions, exemptions, and separate regimes, PECR for communications and device access, and EU GDPR where its territorial scope independently applies. Transfer instruments address Chapter V only.

Exclude genuinely anonymous information and a person's purely personal or household activity with no professional or commercial connection. Pseudonymised information remains personal data when additional information can attribute it to a person. Use DPA 2018 Part 3 for competent-authority law-enforcement processing and Part 4 for intelligence-service processing instead of applying the general-processing map unchanged.

Review this section before approving a new processing purpose, vendor, transfer, profiling flow, DSAR workflow, breach process, or child-facing product change.

Start with an intake that identifies the processing, legal trigger, actor, data, people, risk, recipient, and country. Map a lawful-basis question to an Article 6 necessity note, a special-category question to Article 9 and any Schedule 1 condition, a transfer question to the Article 44A route, and a rights, complaint, or breach question to its own deadline and escalation path.

The decision record should state the action, legal reason, condition or exception, accountable actor, reviewer, evidence, due date, approval, residual risk, and reassessment event. A control is complete only when the live system, contract, notice, or case file matches the decision.