| Scope and covered activity | UK GDPR: define the exact products, services, processing, claims, entities, assets, or activities that bring this side into scope; record out-of-scope facts separately. | Data Protection Act 2018: test its own scope boundary, exclusions, and covered activity; do not copy the UK GDPR conclusion without a separate source-linked finding. | Write two scope findings first: where UK GDPR applies, where Data Protection Act 2018 applies, and which facts are outside one side even if evidence can be reused. |
|---|
| Who must act | UK GDPR: identify the controller, processor, joint controller, representative, data subject, recipient, or supervisory authority role that owns the duty. | Data Protection Act 2018: identify whether the UK-specific rule concerns a controller, competent authority, intelligence service, the Information Commissioner, or a Schedule 1 condition owner. | Name each role separately because one entity can hold different obligations in different workflows. |
|---|
| Trigger or threshold | UK GDPR: state the processing fact that starts the obligation, such as collecting personal data, choosing a lawful basis, handling a data-subject request, reporting a breach, appointing a processor, or making a restricted transfer. | Data Protection Act 2018: check whether the fact pattern invokes UK-specific conditions, exemptions, law-enforcement processing, intelligence-services processing, special-category or criminal-offence safeguards, or ICO enforcement powers. | Start with the trigger so teams do not apply the wrong regime to the wrong facts. |
|---|
| Core obligations | UK GDPR: turn the rule into the concrete action it requires, such as a lawful-basis note, transparency update, processor clause, DPIA, breach assessment, transfer safeguard, or record entry. | Data Protection Act 2018: turn the rule into the domestic-law action it requires, such as a Schedule 1 condition check, special-category justification, law-enforcement safeguard, exemption analysis, or Commissioner-facing record. | Translate obligations into tickets, notices, records, controls, or contract terms. |
|---|
| Evidence and records | UK GDPR: keep the evidence that proves this side of the decision, including cited text, registers, policies, test records, contracts, notices, reports, approvals, or audit artifacts. | Data Protection Act 2018: keep comparator evidence in a distinct record set and link only the artifacts that genuinely satisfy both source-linked requirements. | Keep source links, factual analysis, owner approval, and implementation evidence together. |
|---|
| Timing and cadence | UK GDPR: capture the application date, commencement date, transition period, reporting clock, review cadence, remediation window, or certification renewal that controls this side. | Data Protection Act 2018: track the comparator schedule separately so a later deadline, recurring audit, or incident timer is not hidden by the other workstream. | Use current source dates; do not reuse old project plans after amendments or guidance updates. |
|---|
| Enforcement or assurance route | UK GDPR: identify the competent authority, regulator, assessor, customer audit, certification body, contractual remedy, penalty, or supervisory process tied to this side. | Data Protection Act 2018: identify the comparator enforcement or assurance route and record where supervision, penalties, market access, certification, or contract leverage differs. | Escalate when enforcement routes differ because a regulator, market-surveillance authority, certification body, customer, or contract counterparty may require different proof. |
|---|
| Overlap and reuse | UK GDPR: reuse controls only where the source-linked duty, evidence standard, owner, and timing align with the comparator; otherwise keep a bridge note. | Data Protection Act 2018 can reuse evidence from the other side only when the same fact pattern, system boundary, control, owner, and source-linked requirement are genuinely aligned. | Document overlap explicitly instead of merging both tests into one vague compliance label. |
|---|
| Practical decision rule | UK GDPR: treat this as the controlling workstream when its scope trigger, deadline, regulator, or required artifact is the immediate blocker. | Data Protection Act 2018: run a parallel or follow-on workstream when this side adds separate actors, evidence, timing, penalties, customer assurances, or implementation constraints. | Choose one practical next step: proceed under the UK GDPR, proceed under Data Protection Act 2018, run both in parallel, or document why neither side controls the present fact pattern. |
|---|