Skip to content

Framework

UK GDPR and data protection compliance

Reviewed 6 October 2026

GDPR

The UK GDPR, read alongside the Data Protection Act 2018, governs how organisations process personal data in the United Kingdom. It requires a lawful basis for every processing activity, transparency to data subjects, honouring individual rights, security of processing, and accountability - the ability to demonstrate compliance rather than simply assert it.

Definition

What is GDPR?

The defining principle of the GDPR is accountability. It is not enough to be compliant; an organisation must be able to demonstrate it. That is why records of processing activities, data protection impact assessments, documented lawful bases and evidence of decisions matter so much - they are the demonstration, and their absence is what turns a manageable incident into an enforcement problem.

Six lawful bases exist and consent is only one of them, frequently the weakest. Legitimate interests, contract necessity and legal obligation cover most business processing, and each carries its own conditions. Organisations that default to consent for everything create an obligation to honour withdrawal that they usually cannot technically meet.

UK GDPR diverged from EU GDPR after Brexit but remains substantially aligned, and the UK currently holds an adequacy decision from the European Commission. Organisations processing data about people in both jurisdictions are generally subject to both regimes, and where the two diverge the stricter obligation is the safe operating assumption.

Who GDPR applies to

  • Any organisation established in the UK that processes personal data, regardless of size or sector.
  • Organisations outside the UK offering goods or services to, or monitoring the behaviour of, people in the UK.
  • Processors acting on behalf of controllers, who carry direct obligations of their own and are frequently unaware of it.
  • Organisations deploying AI on personal data, where automated decision-making, profiling and DPIA obligations all bite.
  • Anyone running lead capture, analytics or marketing, where the interaction with PECR is usually the weak point.

The path

How long does GDPR actually take?

Realistic elapsed durations for an organisation starting without a dedicated compliance function. Elapsed time, not effort - the two are routinely confused when this gets scoped.

  1. 013-6 weeks

    Data mapping and records

    Establish what personal data the organisation holds, where it came from, why it is processed, who it is shared with and how long it is kept. The record of processing activities under Article 30 is the foundation for everything else, and it is the first thing a regulator asks for.

  2. 022-4 weeks

    Lawful basis and transparency

    Assign and document a lawful basis for each processing activity, and make the privacy notice reflect what actually happens rather than what a template says. Legitimate interests assessments need writing down, not assuming.

  3. 034-8 weeks

    Rights, security and processors

    Build a workable process for subject access, erasure and objection within the statutory one month. Address security of processing under Article 32, and get Article 28 processor contracts in place with every supplier that touches personal data.

  4. 04Continuous

    Accountability and operation

    DPIAs for high-risk processing, a breach process that can meet the 72-hour notification deadline, retention actually enforced rather than documented, and periodic review. Accountability is a steady state, not a project with an end date.

Cost and internal effort figures are being confirmed with the practice before publication: cost and effort figures · Q15

Failure points

Where GDPR programmes usually go wrong

Not the theory. The specific things that cause a delayed audit, a major non-conformity, or a certificate that does not survive its first surveillance visit.

Consent used where it does not fit

Consent must be freely given, specific, informed and as easy to withdraw as to give. Used for processing the organisation will do regardless - fraud prevention, service delivery, security logging - it is not freely given, and withdrawal creates an obligation the organisation cannot honour. Legitimate interests is usually the correct basis and needs a written assessment.

Retention documented but never enforced

A retention schedule that exists as a policy while systems keep everything indefinitely is worse than no schedule, because it evidences awareness of an obligation the organisation is not meeting. Retention has to be technically implemented, including in backups and analytics.

Subject access requests handled ad hoc

One month is the statutory deadline, extendable by two in limited circumstances. Organisations that have never run the process discover the data is spread across systems nobody can search. The first real request is not the time to find that out.

No DPIA where one is required

A DPIA is mandatory for processing likely to result in high risk, which explicitly includes large-scale profiling, systematic monitoring and most novel AI deployment. Deploying an AI system that affects individuals without one is a documented failure sitting in plain sight.

Processor contracts missing or generic

Article 28 requires specific terms with every processor. Standard supplier agreements frequently lack them, and organisations discover mid-incident that they have no contractual right to audit, no breach notification commitment and no clarity on sub-processors.

Treating PECR as covered by GDPR

The Privacy and Electronic Communications Regulations govern cookies and electronic marketing separately, with their own consent standard. Most cookie banner enforcement in the UK is PECR, not GDPR, and a GDPR programme that ignores it leaves the most visible exposure untouched.

How we run it

GDPR, delivered in sprints

  • 01Data mapping run as discovery with the teams who own the systems, so the record reflects reality rather than an org chart.
  • 02Lawful bases assessed and written down, including legitimate interests assessments, so the position is defensible rather than assumed.
  • 03Subject rights processes tested with a real dry run against a real request, not documented and hoped for.
  • 04DPIA methodology built into the release process, which is the only way it gets done before deployment rather than after.
  • 05Processor contracts reviewed across the supplier estate, prioritised by the sensitivity of what each one touches.
  • 06AI-specific obligations addressed alongside, because automated decision-making and profiling are where data protection and AI governance meet.

Choosing between them

GDPR or ISO 27001?

The UK GDPR is law and applies whether or not an organisation does anything about it. ISO 27001 is a voluntary certification against a management standard. They overlap at exactly one point: Article 32, security of processing, is substantially covered by an ISO 27001 ISMS. Everything else in the GDPR - lawful basis, transparency, subject rights, records of processing, international transfers, DPIAs - sits outside ISO 27001 entirely. An ISO 27001 certificate is useful evidence of security measures if the ICO asks, and it is not a data protection compliance programme. ISO 27701 extends ISO 27001 into privacy management and is the closer fit for organisations wanting a certifiable privacy position.

ISO 27001

FAQ

GDPR: questions people actually ask

Does an organisation need a Data Protection Officer?

A DPO is mandatory for public authorities, and for organisations whose core activities involve large-scale systematic monitoring or large-scale processing of special category data. Most private organisations are not required to appoint one. Where a DPO is not required, someone still needs to own data protection, and the ICO expects to be able to identify who that is.

How long do we have to report a personal data breach?

A controller must notify the ICO within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals. Where the risk to individuals is high, those individuals must also be told without undue delay. Processors must notify their controller without undue delay. The 72 hours runs from awareness, not from full understanding, and a partial notification followed by an update is expected.

Do we need a DPIA before deploying AI?

In most cases involving personal data, yes. A DPIA is mandatory where processing is likely to result in high risk to individuals, and the ICO lists innovative technology, large-scale profiling and automated decision-making with legal or similarly significant effects among the triggers. Most AI deployments touching personal data hit at least one. The DPIA must be completed before processing begins, which is the part that gets missed.

Is consent required for cookies?

Cookies are governed by PECR rather than the GDPR directly. Consent is required for any cookie that is not strictly necessary for a service the user has requested, which includes analytics and all advertising cookies. The consent standard borrows from the GDPR, so it must be freely given, specific and informed, and rejecting must be as easy as accepting. Most UK cookie banner enforcement is PECR action.

Does ISO 27001 make us GDPR compliant?

No. ISO 27001 covers information security, which addresses Article 32 - security of processing - and very little else in the regulation. Lawful basis, transparency, subject rights, records of processing, international transfers and DPIAs are all outside its scope. An ISO 27001 certificate is helpful evidence that security measures are appropriate, and it is not a defence to a data protection complaint about any other article.

Related

ISO 27001ISO 42001SOC 2NIST AI RMFNIST 800-53Cyber EssentialsPCI DSS

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours