UK GDPR Requirements

Start by deciding whether the issue affects controller/processor roles, lawful basis, transparency, DPIA, data-subject rights, breach notification, IDTA/Addendum transfers, children data, or ICO enforcement exposure. The right answer should identify the trigger, the affected process, the required action, the owner, the evidence, and the escalation point.

Keep the UK GDPR source, DPA 2018 context, role map, lawful-basis analysis, DPIA/rights/breach/transfer evidence, and ICO-facing record together.

Ownership should sit with the team that controls the processing purpose, system behavior, vendor terms, transfer mechanism, rights channel, breach process, or child-user journey.

Evidence should show role mapping, lawful basis, Article 9/10 basis where needed, transparency wording, DPIA outcome, DSAR response, breach assessment, transfer mechanism, processor terms, and ICO escalation note.

Most UK GDPR mistakes happen at the boundary between UK GDPR, DPA 2018, PECR, EU GDPR divergence, IDTA/Addendum transfer rules, children data, and processor/subprocessor duties.

Use this section before approving a new processing purpose, vendor, transfer, profiling flow, DSAR workflow, breach process, or child-facing product change.

Start with a short intake that identifies the legal trigger, then decide the required UK GDPR action. For example, map a lawful-basis question to an Article 6 note, a special-category question to the Article 9 or 10 condition, a transfer question to the relevant safeguard, and a rights or breach question to the response deadline and escalation path.

The output should show the action to take, the reason it applies, the owner, the evidence to keep, and when the decision needs review.