Journey

Data protection compliance checklist

Quick compliance check for UK GDPR and Data Protection Act 2018. Verify your payment of the data protection fee to the Information Commission (formerly the ICO), lawful basis documentation, privacy notice, data subject rights process, breach response plan, international transfers, and marketing compliance.

Running Updated 3 November 2026

Quick compliance check

Use this checklist to verify your business meets UK GDPR and Data Protection Act 2018 requirements. Work through each item - if you cannot tick it off, follow the signpost to the relevant guide.

Information Commission fee payment

Check: Is your annual data protection fee paid to the Commission?

Pay the data protection fee to the Information Commission

How to register, determine your fee tier, and set up annual renewal

Fee tiers at a glance

Most small businesses pay Tier 1. Failure to register risks penalties up to 150% of the highest tier fee.

Tier 1 (micro organisations)

£52/year (max 10 staff, under £632K turnover)

Tier 2 (small/medium)

£78/year (under 250 staff, under £36M turnover)

Tier 3 (large)

£3,763/year (250+ staff or £36M+ turnover)

Effective date

From February 2025

Exemptions

Some charities and public authorities exempt

Most organisations processing personal data must pay an annual data protection fee to the Information Commission (formerly the ICO). The tier depends on your staff numbers and turnover.

Information Commission data protection fee (opens in a new tab)
Lawful basis for processing

Check: Have you documented which lawful basis applies to each type of personal data you process?

The six lawful bases

You cannot process personal data without a valid lawful basis. Document your basis for each processing activity before you start - you cannot change it retrospectively without good reason.

Under UK GDPR Article 6, you must have a valid lawful basis to process personal data. You cannot process personal data without identifying at least one lawful basis that applies to each processing activity.

1. Consent (Article 6(1)(a))

The individual has given clear, specific, informed consent for you to process their personal data for a specific purpose

2. Contract (Article 6(1)(b))

Processing is necessary to fulfil a contract with the individual, or to take steps at their request before entering a contract

3. Legal obligation (Article 6(1)(c))

Processing is necessary to comply with a common law or statutory obligation under UK law

4. Vital interests (Article 6(1)(d))

Processing is necessary to protect someone's life

5. Public task (Article 6(1)(e))

Processing is necessary for performing a task in the public interest or for official functions that have a clear basis in law

6. Legitimate interests (Article 6(1)(f))

Processing is necessary for your legitimate interests or those of a third party, unless overridden by the individual's interests, rights, or freedoms

Consent requirements: Must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.

Legitimate interests: Requires a documented Legitimate Interest Assessment (LIA) balancing test. Not available to public authorities for their core tasks.

7. Recognised legitimate interests (NEW - from February 2026)

Processing necessary for certain pre-approved purposes without requiring a balancing test (Data (Use and Access) Act 2025)

Recognised purposes include

National/public security, defence, emergencies, crime prevention/detection, safeguarding vulnerable individuals

Effective date

5 February 2026

Note: Direct marketing and intra-group data sharing still require a Legitimate Interest Assessment even under recognised legitimate interests.

ICO guide to lawful basis (opens in a new tab)

Data protection for businesses

Full guidance on choosing and documenting lawful bases, including special category data
Privacy notice in place

Check: Do you have a privacy notice that tells people what data you collect, why, and what you do with it?

Your privacy notice must be clear, accessible, and cover all your processing activities. Update it when anything changes.

Privacy notice requirements

What your privacy notice must contain under UK GDPR Articles 13 and 14
Data subject rights process

Check: Do you have a process for handling requests from individuals (access, erasure, correction)?

You must respond within one month. Train staff to recognise requests - they do not need to use formal language.

Handling data subject requests

The eight individual rights under UK GDPR and how to respond within the one-month deadline
Data breach response plan
Check: Do you have a documented plan for handling data breaches, including who to notify and when?
72-hour notification rule

You have just 72 hours to report breaches that risk harm to individuals. Without a plan, you will not have time to work out your process during a crisis.
UK GDPR requires data controllers to report certain personal data breaches to the Information Commission (formerly the ICO) and, in some cases, to the individuals affected.

Information Commission notification deadline

Within 72 hours of becoming aware of the breach

Clock starts when

You have 'reasonable certainty' a breach has occurred, not when you know full details

When notification required

If the breach is likely to result in a risk to people's rights and freedoms

When notification NOT required

If breach is unlikely to result in any risk to individuals - but must still record internally

Individual notification

Required without undue delay if risk to individuals is HIGH

Legislation

UK GDPR Articles 33 and 34

Required notification content (Article 33(3))

Nature of the breach (what happened)

Categories and approximate numbers of individuals affected

Categories and approximate numbers of records affected

Name and contact details of your DPO or other contact point

Likely consequences of the breach

Measures taken or proposed to address the breach and mitigate harm

Phased reporting

If full information unavailable within 72 hours, report what you know and provide details later 'without undue further delay'

Internal record-keeping

ALL breaches must be documented (whether notified to the Information Commission or not) for audit purposes

Penalty for notification failure

Up to £8.7 million or 2% of global annual turnover (whichever is higher)

Report a breach to the Information Commission (opens in a new tab)
Data breach response

What counts as a reportable breach, assessing risk, notification deadlines, and communicating with affected individuals
International data transfers

Check: If you transfer personal data outside the UK, do you have appropriate safeguards in place?

This applies to cloud services, overseas suppliers, and international group companies - many businesses transfer data internationally without realising it.

International data transfers

Adequacy decisions, Standard Contractual Clauses, the UK IDTA, and Transfer Risk Assessments
Electronic marketing compliance (PECR)

Check: Do you have valid consent for marketing emails, texts, and calls?

Marketing compliance is one of the most common reasons for Commission enforcement action. The rules work alongside UK GDPR.

Electronic marketing rules (PECR)

Consent requirements, the soft opt-in exception, telephone preference screening, and cookie compliance

Annual review

Data protection is not a one-off exercise. Go through the list below at least once a year and whenever your business activities change significantly.

What to have in place

The data protection fee paid to the Commission each year, unless you are exempt A recorded lawful basis for each purpose you use personal data for Privacy information that covers everything you do with personal data A way to recognise and answer requests from individuals within one month A breach log and a named person who reports breaches to the Commission A written contract with every processor that handles personal data for you A record of your processing activities, if you need one A data protection impact assessment (DPIA) for any processing likely to pose a high risk to people A data protection officer, if you need one

Carry out a data protection impact assessment (DPIA)

When a DPIA is required and what it must cover.

Guv’s take

Accountability principle: You must be able to demonstrate compliance, not just claim it. Keep records of your lawful basis decisions, consent records, breach logs, and training records.

Information Commission for small businesses (opens in a new tab)

Data protection compliance checklist

Quick compliance check

Information Commission fee payment

Lawful basis for processing

Privacy notice in place

Data subject rights process

Data breach response plan

International data transfers

Electronic marketing compliance (PECR)

Annual review

Next steps

Growing your business

Start importing goods to the UK

Transfer ownership of your business

Related journeys

Meet your data protection obligations

Understanding UK GDPR from scratch

Run a tech business

Respond to an Information Commission investigation