UK GDPR Data Protection Readiness Assessment

The UK GDPR applies if you are established in the UK and process personal data, or if you are outside the UK but offer goods or services to, or monitor the behavior of, individuals in the UK. It does not apply to purely personal or household activities, certain law enforcement processing, or intelligence services processing.

The UK GDPR's accountability principle expects organizations to know where personal data comes from, where it is stored, how long it is retained, who can access it, and how it flows internally and externally. It also reflects UK GDPR recordkeeping expectations, including Records of Processing Activities for controllers and processors where applicable.

The UK GDPR distinguishes ordinary personal data from special category data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data, and data concerning sex life or sexual orientation.

Article 6 of the UK GDPR requires a lawful basis for each processing activity: consent, contract, legal obligation, vital interests, public task, legitimate interests, and recognized legitimate interests, and expects a lawful basis to be identified and documented for each processing activity.

Under Articles 4(11) and 7 of the UK GDPR, valid consent must be freely given, specific, informed, and unambiguous, given by a clear affirmative act, and easy to withdraw. New consent may be needed where purposes or processing materially change.

Under the UK GDPR, special category data requires both an Article 6 lawful basis and an Article 9 condition. It also notes that for information society services offered to children under 13, consent or authorization by a person with parental responsibility is required, with reasonable efforts to verify it.

Articles 12–14 of the UK GDPR require privacy notices to be concise, transparent, and easy to understand, and to include controller identity, purposes, lawful basis, recipients, international transfers, retention, rights, withdrawal of consent where relevant, complaint rights, and information about automated decision-making. Separate expectations are included for data collected indirectly under Article 14. Notices should also now reflect the changes made by the Data (Use and Access) Act 2025, including any reliance on recognized legitimate interests.

Articles 12 and 15–22 of the UK GDPR give individuals rights of access, rectification, erasure, restriction, portability, objection, and related rights regarding automated decisions. It also expects lawful handling of refusals, including justification, timing, and informing individuals about complaint and judicial remedy rights.

The UK GDPR sets out specific grounds and exemptions for erasure, rules on restricting processing, a duty to notify recipients of rectification, erasure, or restriction, and a right to receive portable data in a structured, machine-readable format. Where an individual objects to processing, it must stop unless compelling legitimate grounds override the objection — except for direct marketing, where the right to object is absolute and no override is available.

The UK GDPR requires a mechanism to ensure that significant decisions are not made solely through automated processing unless a permitted condition applies, and that safeguards exist so individuals can receive information, make representations, request human intervention, and contest decisions.

The UK GDPR expects defined privacy roles, accountability mechanisms, possible DPO appointment where required, lawful and fair processing, adherence to core data protection principles, privacy by design and by default, retention and destruction controls, data accuracy processes, and, where relevant, a UK representative for non-UK organizations.

The UK GDPR requires measures such as policies, training, audits, vendor vetting, incident reporting, MFA, retention and disposal controls, encryption, anonymization or pseudonymization, RBAC, firewalls, backup and recovery, secure storage, surveillance, access control systems, visitor controls, and secured workstations. It also asks whether measures are proportionate to risks, implementation cost, and processing context.

The UK GDPR states that a DPIA is required where processing is likely to result in a high risk to rights and freedoms, including certain uses of new technologies, significant profiling or automated decisions, large-scale processing of sensitive or criminal data, and public monitoring. It also recommends regular audits and independent reviews.

The UK GDPR expects cross-border transfers to comply with Articles 45–49, including transfer mechanisms and where needed, a transfer risk assessment. It also requires engaging only processors with adequate technical and organizational measures and ensuring that processor obligations are met contractually and operationally.

The UK GDPR requires a breach notification to the Commissioner within 72 hours where required, reasons for delay if applicable, prompt processor-to-controller notification, complete breach notification content, records of all breaches, and prompt communication to affected data subjects where a high risk to rights and freedoms exists.