Identify the duties that apply to each processing activity, then assign the decisions, controls, deadlines and evidence to the responsible team.
Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.
The UK GDPR, supplemented by the Data Protection Act 2018, applies requirements to each processing activity according to scope, role, purpose, data, people, risk, technology, recipients, and transfers. It has applied in its UK form since 1 January 2021, and the Data (Use and Access) Act 2025 amendments are now in force. Use this map to connect each legal decision, deadline, exception, owner, control, and evidence record.
Map the seven principles first, including . Then attach Article 6 and any Article 9 or 10 condition, privacy information, rights, privacy by design and default, processor and joint-controller arrangements, records, security, breach readiness, DPIA or DPO triggers, and Chapter V transfer controls.
Reflect the current consolidated UK text, including recognised legitimate interests, amended request timing and access searches, Articles 22A-22D, the revised transfer route, PECR storage-and-access exceptions, and the data protection complaints process. Legislation is binding; ICO material explains the regulator's interpretation and expected practice. Recheck older guidance and templates where the law has changed.
Sources (5)
Binding source for the principles, lawful bases, rights, controller and processor duties, Articles 22A-22D, security, breaches, DPIAs, and Articles 44A-49A.
GOV.UK source for the UK international-transfer toolkit and adequacy-assessment context referenced by UK GDPR requirements workflows.
GOV.UK explainer for UK-US data bridge conditions and protection-level rationale under the UK GDPR.
ICO guidance for mapping UK GDPR security requirements into proportionate technical and organisational measures.
Current ICO summary confirming that all data-protection provisions are in force and identifying the amended lawful-basis, rights, automated-decision, cookie, complaint, and transfer rules.
Assign each requirement to the actor that can perform it. Controllers decide purposes and essential means and remain responsible for compliance; processors act on documented instructions and have direct duties including security, records, cooperation, and breach escalation. Joint controllers must allocate responsibilities transparently, although people may exercise rights against either controller.
Evidence should show both the legal decision and operation: the processing record, notice, contract, system setting, access review, deletion result, request case, complaint case, security test, DPIA, breach assessment, transfer record, approval, and remediation. The evidence set must match the activity rather than repeat every possible document.
Sources (4)
Binding source for controller accountability, joint-controller arrangements, processor duties and contracts, records, and cooperation.
GOV.UK explainer for UK-US data bridge conditions and protection-level rationale under the UK GDPR.
ICO guidance for mapping UK GDPR security requirements into proportionate technical and organisational measures.
ICO audit framework used to test practices against regulatory expectations and identify evidence for improvement actions.
At a boundary, identify which instrument supplies the rule: UK GDPR for general processing, the Data Protection Act 2018 for UK conditions, exemptions, and separate regimes, PECR for communications and device access, and EU GDPR where its territorial scope independently applies. Transfer instruments address Chapter V only.
Exclude genuinely anonymous information and a person's purely personal or household activity with no professional or commercial connection. Pseudonymised information remains personal data when additional information can attribute it to a person. Use DPA 2018 Part 3 for competent-authority law-enforcement processing and Part 4 for intelligence-service processing instead of applying the general-processing map unchanged.
Review this section before approving a new processing purpose, vendor, transfer, profiling flow, DSAR workflow, breach process, or child-facing product change.
Sources (6)
Binding source for material and territorial scope and the exclusions that separate general processing from other regimes.
Binding source for UK conditions, exemptions, enforcement, and separate law-enforcement and intelligence-services processing.
GOV.UK source for the UK international-transfer toolkit and adequacy-assessment context referenced by UK GDPR requirements workflows.
GOV.UK explainer for UK-US data bridge conditions and protection-level rationale under the UK GDPR.
ICO guidance for mapping UK GDPR security requirements into proportionate technical and organisational measures.
ICO audit framework used to test practices against regulatory expectations and identify evidence for improvement actions.
Start with an intake that identifies the processing, legal trigger, actor, data, people, risk, recipient, and country. Map a lawful-basis question to an Article 6 necessity note, a special-category question to Article 9 and any Schedule 1 condition, a transfer question to the Article 44A route, and a rights, complaint, or breach question to its own deadline and escalation path.
The decision record should state the action, legal reason, condition or exception, accountable actor, reviewer, evidence, due date, approval, residual risk, and reassessment event. A control is complete only when the live system, contract, notice, or case file matches the decision.
Sources (6)
Binding source for mapping each processing trigger to the required action, responsible actor, evidence, and deadline.
GOV.UK source for the UK international-transfer toolkit and adequacy-assessment context referenced by UK GDPR requirements workflows.
GOV.UK explainer for UK-US data bridge conditions and protection-level rationale under the UK GDPR.
ICO guidance for mapping UK GDPR security requirements into proportionate technical and organisational measures.
Current regulator summary for the complaint deadline and the amended rights, automated-decision, cookie, and transfer requirements.
Current operational guidance for complaint intake, acknowledgement, investigation, response, and evidence.
Map each live processing activity to its legal trigger, accountable actor, required action, statutory clock, evidence, exception, approval, and reassessment event.
Create processing, legal-trigger, evidence, owner, and review questions.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.