Data protection compliance

Data protection annual compliance checklist

Annual checklist for verifying your data protection compliance. Covers ICO fee renewal, privacy notices, records of processing, breach procedures, staff training, DPIAs, retention schedules, and international transfers.

UK-wide
Guide summary

Check your business meets UK data protection rules every year. Pay the ICO fee, update privacy notices, and train staff. Fines for missing the fee can be up to £4,350.

  • Pay your ICO fee yearly (£52 to £3,763 depending on size)
  • Update privacy notices if you change how you use personal data
  • Check your legal basis for using personal data
  • Keep records of how you process personal data
  • Tell the ICO if data is lost or stolen within 72 hours
  • Train staff to handle personal data safely
  • Assess risks when using data in new ways
  • Check if you transfer data outside the UK
  • Respond to requests about personal data within one month
  • Keep data only as long as needed
On this page
UK-wide

Related guides in Compliance & Legal

Report a cyber incident

Emergency response guide for reporting cyber attacks and data breaches. Covers who to contact (Report Fraud, ICO, NCSC, …

Use this checklist each year to confirm your business meets its data protection obligations under UK GDPR and the Data Protection Act 2018. Work through each section and resolve any gaps before moving on.

Registration and fees

  • ICO data protection fee renewed and paid before the expiry date
  • ICO registration details up to date (business name, address, nature of processing)
  • Correct fee tier confirmed based on current turnover and staff numbers

Privacy and transparency

  • Privacy notices reviewed and updated for any changes to processing activities, data recipients, or retention periods
  • Privacy notices include all mandatory information required by UK GDPR Articles 13 and 14
  • Cookie consent mechanism compliant with PECR and any Data Use and Access Act 2025 changes (consent-or-pay models, analytical cookie reforms)
  • Lawful basis documented for each processing purpose
  • Legitimate interest assessments reviewed for any processing relying on that basis

Individual rights and requests

  • Subject access request (SAR) response process documented and tested within the last 12 months
  • Staff trained on recognising and handling all eight data subject rights requests
  • Response within one calendar month confirmed as standard procedure (with documented escalation for complex requests)
  • Identity verification process in place for rights requests
  • Third-party recipients notified of any rectifications, erasures, or restrictions during the year

Security and breach management

  • Data breach response plan in place and tested (desktop exercise or drill) within the last 12 months
  • Staff trained on identifying and escalating potential breaches
  • 72-hour ICO notification process documented and assigned to a named individual
  • Internal breach register maintained and reviewed for patterns or repeat incidents
  • Technical security measures reviewed (encryption, access controls, backups, patch management)
  • Passwords and access credentials rotated or reviewed in line with your security policy

Governance and accountability

  • Records of processing activities (ROPA) updated to reflect any new or changed processing
  • Data Protection Officer or Senior Responsible Individual appointed and contact details published (if required)
  • Data Protection Impact Assessments (DPIAs) reviewed for all high-risk processing activities
  • New DPIAs completed for any processing introduced during the year that meets mandatory triggers
  • Staff data protection training completed and recorded for all employees handling personal data
  • Data protection policies reviewed and version-controlled

Data management

  • Retention schedule applied and data deleted or anonymised on schedule
  • International transfer mechanisms reviewed and still valid (adequacy decisions, standard contractual clauses, or binding corporate rules)
  • Processor contracts include all required UK GDPR Article 28 clauses
  • Processor compliance verified (security measures, sub-processor controls, breach notification obligations)
  • Data minimisation reviewed: no unnecessary personal data still being collected or held

If you identified gaps in any section, address them promptly. The ICO can issue enforcement notices, reprimands, and fines of up to GBP 17.5 million or 4% of annual worldwide turnover for serious infringements. If you are uncertain about a compliance gap, seek specialist data protection advice before your next ICO fee renewal date.

Related guidance

ICO accountability framework self-assessment (opens in a new tab)

Official guidance and legislation