Journey

Data protection compliance checklist

Quick compliance check for UK GDPR and Data Protection Act 2018. Verify your ICO registration, lawful basis documentation, privacy notice, data subject rights process, breach response plan, international transfers, and marketing compliance.

Running a Business Updated 15 September 2026

7 milestones references 5 guides

Quick compliance check

Use this checklist to verify your business meets UK GDPR and Data Protection Act 2018 requirements. Work through each item - if you cannot tick it off, follow the signpost to the relevant guide.

ICO registration and fee payment
Check: Are you registered with the ICO and is your annual fee paid?

Register with the ICO

How to register, determine your fee tier, and set up annual renewal
Fee tiers at a glance

Most small businesses pay Tier 1. Failure to register risks penalties up to 150% of the highest tier fee.
Under the Data Protection (Charges and Information) Regulations 2018, most organisations that process personal data must pay an annual data protection fee to the Information Commissioner's Office (ICO).

Tier 1 fee (micro organisations)

£52 per year

Tier 1 threshold

Annual turnover up to £632,000 AND 10 or fewer staff

Tier 1 Direct Debit

£47 per year (£5 discount)

Tier 2 fee (SMEs)

£78 per year

Tier 2 threshold

Annual turnover up to £36 million AND 250 or fewer staff

Tier 2 Direct Debit

£73 per year (£5 discount)

Tier 3 fee (large organisations)

£3,763 per year

Tier 3 threshold

Annual turnover over £36 million OR over 250 staff

Tier 3 Direct Debit

£3,758 per year (£5 discount)

Effective from

17 February 2025

Charities

Pay Tier 1 fee only (£52), regardless of size or turnover

Penalty for non-payment

Up to 150% of the highest charge payable (DPA 2018 section 158(3)), plus the fee owed

Payment deadline after notice

28 days to pay or make representations

Renewal

Annual - ICO sends renewal reminder before expiry

Who must pay

You must register if your business:

Processes personal information about individuals (customers, employees, suppliers)

Uses CCTV (including smart doorbells or dashcams for business purposes)

Maintains marketing lists

Uses cookies on your website

Limited exemptions

Very few organisations are exempt. You may be exempt only if you:

Only process personal data for personal or household purposes (not business)

Are an MP, elected representative, or judge (specific exemptions)

Have no automated processing (no computers, no CCTV) - extremely rare

Most businesses are NOT exempt - if you have customer or employee data, you almost certainly need to pay.

Pay the data protection fee (opens in a new tab)

ICO fee self-assessment tool (opens in a new tab)
Lawful basis for processing

Check: Have you documented which lawful basis applies to each type of personal data you process?

The six lawful bases

You cannot process personal data without a valid lawful basis. Document your basis for each processing activity before you start - you cannot change it retrospectively without good reason.

Under UK GDPR Article 6, you must have a valid lawful basis to process personal data. You cannot process personal data without identifying at least one lawful basis that applies to each processing activity.

1. Consent (Article 6(1)(a))

The individual has given clear, specific, informed consent for you to process their personal data for a specific purpose

2. Contract (Article 6(1)(b))

Processing is necessary to fulfil a contract with the individual, or to take steps at their request before entering a contract

3. Legal obligation (Article 6(1)(c))

Processing is necessary to comply with a common law or statutory obligation under UK law

4. Vital interests (Article 6(1)(d))

Processing is necessary to protect someone's life

5. Public task (Article 6(1)(e))

Processing is necessary for performing a task in the public interest or for official functions that have a clear basis in law

6. Legitimate interests (Article 6(1)(f))

Processing is necessary for your legitimate interests or those of a third party, unless overridden by the individual's interests, rights, or freedoms

Consent requirements: Must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.

Legitimate interests: Requires a documented Legitimate Interest Assessment (LIA) balancing test. Not available to public authorities for their core tasks.

7. Recognised legitimate interests (NEW - from February 2026)

Processing necessary for certain pre-approved purposes without requiring a balancing test (Data (Use and Access) Act 2025)

Recognised purposes include

National/public security, defence, emergencies, crime prevention/detection, safeguarding vulnerable individuals

Effective date

5 February 2026

Note: Direct marketing and intra-group data sharing still require a Legitimate Interest Assessment even under recognised legitimate interests.

ICO guide to lawful basis (opens in a new tab)

Data protection for businesses

Full guidance on choosing and documenting lawful bases, including special category data
Privacy notice in place

Check: Do you have a privacy notice that tells people what data you collect, why, and what you do with it?

Your privacy notice must be clear, accessible, and cover all your processing activities. Update it when anything changes.

Privacy notice requirements

What your privacy notice must contain under UK GDPR Articles 13 and 14
Data subject rights process

Check: Do you have a process for handling requests from individuals (access, erasure, correction)?

You must respond within one month. Train staff to recognise requests - they do not need to use formal language.

Handling data subject requests

The eight individual rights under UK GDPR and how to respond within the one-month deadline
Data breach response plan
Check: Do you have a documented plan for handling data breaches, including who to notify and when?
72-hour notification rule

You have just 72 hours to report breaches that risk harm to individuals. Without a plan, you will not have time to work out your process during a crisis.
UK GDPR requires data controllers to report certain personal data breaches to the ICO and, in some cases, to the individuals affected.

ICO notification deadline

Within 72 hours of becoming aware of the breach

Clock starts when

You have 'reasonable certainty' a breach has occurred, not when you know full details

When notification required

If the breach is likely to result in a risk to people's rights and freedoms

When notification NOT required

If breach is unlikely to result in any risk to individuals - but must still record internally

Individual notification

Required without undue delay if risk to individuals is HIGH

Legislation

UK GDPR Articles 33 and 34

Required notification content (Article 33(3))

Nature of the breach (what happened)

Categories and approximate numbers of individuals affected

Categories and approximate numbers of records affected

Name and contact details of your DPO or other contact point

Likely consequences of the breach

Measures taken or proposed to address the breach and mitigate harm

Phased reporting

If full information unavailable within 72 hours, report what you know and provide details later 'without undue further delay'

Internal record-keeping

ALL breaches must be documented (whether notified to ICO or not) for audit purposes

Penalty for notification failure

Up to £8.7 million or 2% of global annual turnover (whichever is higher)

Report a breach to the ICO (opens in a new tab)
Data breach response

What counts as a reportable breach, assessing risk, notification deadlines, and communicating with affected individuals
International data transfers

Check: If you transfer personal data outside the UK, do you have appropriate safeguards in place?

This applies to cloud services, overseas suppliers, and international group companies - many businesses transfer data internationally without realising it.

International data transfers

Adequacy decisions, Standard Contractual Clauses, the UK IDTA, and Transfer Risk Assessments
Electronic marketing compliance (PECR)

Check: Do you have valid consent for marketing emails, texts, and calls?

Marketing compliance is one of the most common reasons for ICO enforcement action. The rules work alongside UK GDPR.

Electronic marketing rules (PECR)

Consent requirements, the soft opt-in exception, telephone preference screening, and cookie compliance

Annual review

Data protection is not a one-off exercise. Review this checklist at least annually and whenever your business activities change significantly.

Guv’s take

Accountability principle: You must be able to demonstrate compliance, not just claim it. Keep records of your lawful basis decisions, consent records, breach logs, and training records.

Data protection compliance checklist

Quick compliance check

ICO registration and fee payment

Register with the ICO

Lawful basis for processing

Data protection for businesses

Privacy notice in place

Privacy notice requirements

Data subject rights process

Handling data subject requests

Data breach response plan

Data breach response

International data transfers

International data transfers

Electronic marketing compliance (PECR)

Electronic marketing rules (PECR)

Annual review

Related journeys

Meet your data protection obligations

Understanding UK GDPR from scratch

Run a tech business

Respond to an ICO investigation