GDPR Compliance Checklist for UK Businesses

1. Lawful Basis for Processing

Ensure you have identified and documented a lawful basis for each processing activity:

The Six Lawful Bases

• Consent: Freely given, specific, informed, and unambiguous
• Contract: Necessary for contract performance with the individual
• Legal Obligation: Required by law
• Vital Interests: Protecting someone's life
• Public Task: Official functions or public interest
• Legitimate Interests: Balanced against individual rights (requires LIA)

Checklist Items

• ☐ Document lawful basis for each processing activity in your ROPA
• ☐ Complete Legitimate Interest Assessments where applicable
• ☐ Review consent mechanisms for validity and granularity
• ☐ Ensure consent is as easy to withdraw as to give
• ☐ Identify special category data and additional lawful basis

2. Privacy Notices and Transparency

Individuals must be informed about how their data is processed:

Checklist Items

• ☐ Privacy notice covers all required Articles 13/14 information
• ☐ Notice is concise, transparent, and easily accessible
• ☐ Separate notices for employees, customers, and website visitors
• ☐ Privacy notice reviewed and updated at least annually
• ☐ Cookie notice and consent mechanism implemented (PECR compliance)
• ☐ Layered approach used for complex processing

3. Data Subject Rights

Establish processes to handle data subject requests within required timeframes:

Individual Rights

• Access: Right to obtain copy of personal data (1 month)
• Rectification: Right to correct inaccurate data
• Erasure: Right to deletion ("right to be forgotten")
• Restriction: Right to limit processing
• Portability: Right to receive data in portable format
• Object: Right to object to processing
• Automated Decisions: Rights regarding profiling

Checklist Items

• ☐ Process for receiving and verifying DSARs
• ☐ Ability to respond within one month (extendable to 3 months for complex requests)
• ☐ Template responses for each right type
• ☐ Escalation process for complex or disputed requests
• ☐ Log of all requests and responses maintained

4. Records of Processing Activities (ROPA)

Maintain comprehensive records of all processing activities:

Checklist Items

• ☐ ROPA includes all required Article 30 information
• ☐ Processing purposes documented clearly
• ☐ Categories of data subjects and personal data recorded
• ☐ Recipients and international transfers documented
• ☐ Retention periods specified for each processing activity
• ☐ Security measures described
• ☐ ROPA reviewed and updated regularly (quarterly recommended)

5. Data Protection Impact Assessments

Conduct DPIAs for high-risk processing activities:

Checklist Items

• ☐ DPIA screening process established
• ☐ DPIA template aligned with ICO guidance
• ☐ DPIAs completed for high-risk processing before it begins
• ☐ Residual risks documented and formally accepted
• ☐ ICO consultation where residual high risk remains

6. Data Security

Implement appropriate technical and organisational measures:

Checklist Items

• ☐ Encryption for data at rest and in transit
• ☐ Access controls and authentication mechanisms
• ☐ Regular security testing and vulnerability assessments
• ☐ Staff security awareness training
• ☐ Incident response procedures documented and tested
• ☐ Business continuity and disaster recovery plans
• ☐ Physical security measures for premises and equipment

7. Data Breach Management

Prepare for and respond to personal data breaches:

Checklist Items

• ☐ Breach detection and internal reporting procedures
• ☐ Breach assessment methodology (risk to individuals)
• ☐ ICO notification process (within 72 hours where required)
• ☐ Individual notification templates and criteria
• ☐ Breach register maintained with all incidents
• ☐ Post-breach review and lessons learned process

8. International Transfers

Ensure lawful transfers outside the UK:

Checklist Items

• ☐ Identify all international data transfers
• ☐ Verify adequacy decisions or implement appropriate safeguards
• ☐ International Data Transfer Agreement (IDTA) where required
• ☐ Transfer Impact Assessments completed
• ☐ Supplementary measures implemented if needed

9. Third-Party Management

Manage processors and ensure contractual compliance:

Checklist Items

• ☐ Processor due diligence process established
• ☐ Data Processing Agreements with all processors
• ☐ DPAs include all Article 28 requirements
• ☐ Sub-processor approval mechanism in place
• ☐ Regular processor compliance reviews conducted

10. Accountability and Governance

Demonstrate compliance through documentation and governance:

Checklist Items

• ☐ Data Protection Officer appointed (if required)
• ☐ Data protection policies in place and communicated
• ☐ Staff training programme with completion tracking
• ☐ Regular compliance audits conducted
• ☐ Board-level reporting on data protection matters
• ☐ ICO registration current and accurate

Conclusion

GDPR compliance is an ongoing process, not a one-time project. Use this checklist as a foundation for your compliance programme, but remember that requirements may vary based on your specific processing activities and risk profile.

Regular reviews, staff training, and staying current with ICO guidance are essential for maintaining compliance and protecting both your organisation and the individuals whose data you process.