Journey

Meet your data protection obligations

Ensure your business complies with UK GDPR and the Data Protection Act 2018. Covers the data protection fee, lawful basis for processing, data subject rights, international transfers, breach notification, and electronic marketing rules under PECR.

Running Updated 3 November 2026

Data protection compliance for UK businesses

Every business that processes personal data must comply with UK GDPR and the Data Protection Act 2018. This includes collecting customer details, managing employee records, operating CCTV, or running marketing campaigns.

The Information Commission (formerly the ICO) enforces data protection law. Serious breaches can result in fines of up to £17.5 million or 4% of annual worldwide turnover (whichever is higher). Beyond fines, poor data protection damages customer trust and can disrupt your business operations.

Pay the data protection fee to the Information Commission

Most businesses that process personal data must pay an annual data protection fee to the Commission. This applies whether you have one employee or thousands. The fee depends on your size and turnover.

Pay the data protection fee and understand your obligations

Learn about UK GDPR requirements, the seven data protection principles, and how to pay the data protection fee to the Information Commission.

Data protection fees

The fee is tiered based on your organisation size and turnover. Most small businesses pay the Tier 1 fee. You must renew annually.

Tier 1 (micro organisations)

£52/year (max 10 staff, under £632K turnover)

Tier 2 (small/medium)

£78/year (under 250 staff, under £36M turnover)

Tier 3 (large)

£3,763/year (250+ staff or £36M+ turnover)

Effective date

From February 2025

Exemptions

Some charities and public authorities exempt

Most organisations processing personal data must pay an annual data protection fee to the Information Commission (formerly the ICO). The tier depends on your staff numbers and turnover.

Information Commission data protection fee (opens in a new tab)

Pay your data protection fee (opens in a new tab)
Identify your lawful basis for processing

You need a valid legal reason (lawful basis) for every type of personal data you process. The six lawful bases under UK GDPR are: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Choosing the wrong basis - or having no basis at all - is a fundamental breach.

The lawful bases under UK GDPR

Document which lawful basis applies to each processing activity. You cannot change your lawful basis later without a valid reason, so get this right from the start.

Under UK GDPR Article 6, you must have a valid lawful basis to process personal data. You cannot process personal data without identifying at least one lawful basis that applies to each processing activity.

1. Consent (Article 6(1)(a))

The individual has given clear, specific, informed consent for you to process their personal data for a specific purpose

2. Contract (Article 6(1)(b))

Processing is necessary to fulfil a contract with the individual, or to take steps at their request before entering a contract

3. Legal obligation (Article 6(1)(c))

Processing is necessary to comply with a common law or statutory obligation under UK law

4. Vital interests (Article 6(1)(d))

Processing is necessary to protect someone's life

5. Public task (Article 6(1)(e))

Processing is necessary for performing a task in the public interest or for official functions that have a clear basis in law

6. Legitimate interests (Article 6(1)(f))

Processing is necessary for your legitimate interests or those of a third party, unless overridden by the individual's interests, rights, or freedoms

Consent requirements: Must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.

Legitimate interests: Requires a documented Legitimate Interest Assessment (LIA) balancing test. Not available to public authorities for their core tasks.

7. Recognised legitimate interests (NEW - from February 2026)

Processing necessary for certain pre-approved purposes without requiring a balancing test (Data (Use and Access) Act 2025)

Recognised purposes include

National/public security, defence, emergencies, crime prevention/detection, safeguarding vulnerable individuals

Effective date

5 February 2026

Note: Direct marketing and intra-group data sharing still require a Legitimate Interest Assessment even under recognised legitimate interests.

ICO guide to lawful basis (opens in a new tab)

Guv’s take

Special category data: Some types of personal data need extra protection - including health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and sexual orientation. You need both a lawful basis AND a separate condition under Article 9 to process this data.
Respond to data subject rights requests
Individuals have rights over their personal data. When someone makes a request - such as asking for a copy of their data or asking you to delete it - you must respond within one month. Failing to do so is a breach that individuals can complain to the Commission about.
Individual rights under UK GDPR

Train your staff to recognise rights requests and have a process for handling them. Not all rights apply in all circumstances, but you must assess each request properly.
Individuals have the following rights regarding their personal data:

Right to be informed - know how you use their data

Right of access (DSAR) - request copies of their data

Right to rectification - have inaccurate data corrected

Right to erasure - have data deleted ("right to be forgotten")

Right to restrict processing - limit how you use data

Right to data portability - receive data in portable format

Right to object - object to processing

Rights related to automated decisions - challenge automated profiling

DSAR response deadline

1 month (can extend to 3 months for complex requests)

DSAR cost

Free (unless manifestly unfounded/excessive)
Data protection overview and compliance requirements

Detailed guidance on handling Subject Access Requests, erasure requests, and other data subject rights.
Ensure lawful international data transfers

Transferring personal data outside the UK requires additional safeguards. This applies whenever you use cloud services hosted abroad, share data with overseas partners, or send employee information to a foreign head office. Many businesses underestimate how many international transfers they make.

International data transfer requirements

Understand adequacy decisions, Standard Contractual Clauses, the UK IDTA, Transfer Risk Assessments, and when exemptions apply.

Guv’s take

Countries with UK adequacy decisions: Transfers to the EEA, Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, and US (certified DPF organisations) can proceed without additional safeguards. For all other countries, you need SCCs, the UK IDTA, or another approved mechanism.

ICO international transfers guidance (opens in a new tab)
Report data breaches within 72 hours
When a data breach occurs, you have just 72 hours to report it to the Commission if it poses a risk to individuals. Some breaches also require you to notify the affected individuals directly. Having a breach response plan before an incident occurs is essential - you will not have time to work out your process during a crisis.

Data breach response requirements

What counts as a reportable breach, how to assess risk, the 72-hour notification deadline, and what to tell affected individuals.
72-hour breach notification rule

The clock starts when you become aware of a breach. If you cannot report within 72 hours, you must explain the delay. Document all breaches, even those you decide not to report.
UK GDPR requires data controllers to report certain personal data breaches to the Information Commission (formerly the ICO) and, in some cases, to the individuals affected.

Information Commission notification deadline

Within 72 hours of becoming aware of the breach

Clock starts when

You have 'reasonable certainty' a breach has occurred, not when you know full details

When notification required

If the breach is likely to result in a risk to people's rights and freedoms

When notification NOT required

If breach is unlikely to result in any risk to individuals - but must still record internally

Individual notification

Required without undue delay if risk to individuals is HIGH

Legislation

UK GDPR Articles 33 and 34

Required notification content (Article 33(3))

Nature of the breach (what happened)

Categories and approximate numbers of individuals affected

Categories and approximate numbers of records affected

Name and contact details of your DPO or other contact point

Likely consequences of the breach

Measures taken or proposed to address the breach and mitigate harm

Phased reporting

If full information unavailable within 72 hours, report what you know and provide details later 'without undue further delay'

Internal record-keeping

ALL breaches must be documented (whether notified to the Information Commission or not) for audit purposes

Penalty for notification failure

Up to £8.7 million or 2% of global annual turnover (whichever is higher)

Report a breach to the Information Commission (opens in a new tab)
Report a data breach to the Information Commission (opens in a new tab)
Comply with electronic marketing rules (PECR)
The Privacy and Electronic Communications Regulations (PECR) set additional rules for marketing emails, texts, and telephone calls. These work alongside UK GDPR. Getting consent wrong for marketing is one of the most common reasons for Commission enforcement action.

Electronic marketing rules under PECR

Consent requirements, the soft opt-in exception for existing customers, TPS screening for calls, and avoiding Information Commission penalties.

PECR maximum penalties

Following the Data Use and Access Act 2025, PECR fines now align with GDPR levels. The Commission regularly issues substantial fines for nuisance calls and unsolicited marketing.

From 5 February 2026, maximum penalties for PECR breaches have been aligned with UK GDPR levels under the Data (Use and Access) Act 2025.

Previous maximum fine

£500,000

New maximum fine (from 5 February 2026)

£17.5 million or 4% of global annual turnover, whichever is higher

Effective date

5 February 2026

Legal basis

Data (Use and Access) Act 2025

Applies to

Unlawful email/SMS marketing, telemarketing, cookies/tracking breaches

Regulator

Information Commission

Common PECR breaches

Unsolicited marketing, ignoring opt-outs, manipulative cookie consent

ICO enforcement (2022-2025)

49 PECR fines totalling £4.63 million

Average fine (pre-2025)

£94,490

Expected focus areas

Mass unsolicited communications, TPS/CTPS violations, deceptive consent flows

ICO PECR enforcement guidance (opens in a new tab)
Cookie consent requirements

PECR also covers cookies and similar tracking technologies. Most cookies require consent before being placed on a user's device.
The Privacy and Electronic Communications Regulations 2003 (PECR) require consent before setting cookies unless a statutory exemption applies.

Consent requirements:

Clear and comprehensive information about cookies

Genuine choice - no "cookie walls" forcing acceptance

Easy to withdraw consent

No pre-ticked boxes

Exempt cookies:

Strictly necessary for the service (e.g., shopping cart)

Enabling user-requested functionality

Analytics cookies require consent unless all conditions of the statistical-purposes exemption in Schedule A1, paragraph 5 are met: sole use for service or website improvement statistics, restricted sharing, clear information and a simple free opt-out that is respected. Advertising and social media tracking cookies require consent.
Understand the consequences of non-compliance
The Commission has significant enforcement powers. Beyond fines, the Commission can issue enforcement notices requiring you to stop processing data, conduct compulsory audits, and publicise your failings. Serious breaches damage your reputation and can result in legal action from affected individuals.
UK GDPR maximum fines

There are two tiers of fines. The higher tier applies to fundamental breaches such as processing without lawful basis, ignoring data subject rights, or unlawful international transfers.
The Commission can issue administrative fines under UK GDPR Article 83 and DPA 2018 Section 157. There are two tiers of maximum fines depending on the type of infringement.

Higher tier maximum

£17.5 million or 4% of annual worldwide turnover, whichever is HIGHER

Higher tier applies to

Breaches of data protection principles (Article 5), lawful basis requirements (Articles 6, 7, 9), data subject rights (Articles 12-22), unlawful international transfers (Articles 44-49)

Standard tier maximum

£8.7 million or 2% of annual worldwide turnover, whichever is HIGHER

Standard tier applies to

Failure to comply with controller/processor obligations, processing children's data incorrectly, certification failures, breach notification failures

Infringements attracting higher tier fines (£17.5m / 4%)

Breaching data protection principles (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability)

Processing without valid lawful basis

Failing to obtain valid consent where required

Processing special category data without a valid condition

Failing to respect data subject rights (access, rectification, erasure, portability, objection)

Unlawful transfers of personal data to third countries

Infringements attracting standard tier fines (£8.7m / 2%)

Failure to comply with controller or processor obligations under Chapter IV

Processing children's data incorrectly (Article 8)

Failure to notify data breaches to the Commission within 72 hours

Failure to notify individuals of high-risk breaches

Failure to comply with certification requirements

Multiple infringements

For same or linked processing operations, total fine cannot exceed amount for gravest infringement

Unlinked operations

Separate fines for unlinked operations can exceed statutory maximum when summed

Information Commission approach

Fines should be effective, proportionate, and dissuasive in each individual case

Legislation reference

UK GDPR Article 83, DPA 2018 Sections 155-157

ICO fining guidance (opens in a new tab)

ICO enforcement actions (opens in a new tab)
Take note

Higher tier fines (up to 17.5m / 4% turnover): Breaches of data protection principles, processing without valid lawful basis, failing to respect data subject rights, unlawful international transfers.

Standard tier fines (up to 8.7m / 2% turnover): Failure to notify breaches within 72 hours, incorrect processing of children's data, certification failures.

ICO enforcement actions (opens in a new tab)
Maintain ongoing compliance

Data protection is not a one-off exercise. Review your processing activities regularly, update your privacy notices when things change, train new staff, and keep records of your compliance efforts. The Commission expects organisations to embed data protection into their operations.

Guv’s take

Accountability principle: Under UK GDPR, you must be able to demonstrate your compliance - not just claim you are compliant. Keep records of your lawful basis decisions, consent records, Data Protection Impact Assessments, and training logs.

ICO guidance and resources (opens in a new tab)

ICO for small businesses (opens in a new tab)

Official guidance

UK GDPR guidance (opens in a new tab)

Full Information Commission guidance on UK GDPR principles and requirements.

ICO

Data Protection Act 2018 (opens in a new tab)

The primary UK data protection legislation.

legislation.gov.uk

UK GDPR (retained EU law) (opens in a new tab)

The UK version of the General Data Protection Regulation.

legislation.gov.uk

PECR guidance (opens in a new tab)

Rules for electronic marketing and cookies.

ICO

ICO enforcement register (opens in a new tab)

Published enforcement actions and monetary penalties.

ICO

Meet your data protection obligations

Data protection compliance for UK businesses

Pay the data protection fee to the Information Commission

Pay the data protection fee and understand your obligations

Identify your lawful basis for processing

Respond to data subject rights requests

Data protection overview and compliance requirements

Ensure lawful international data transfers

International data transfer requirements

Report data breaches within 72 hours

Data breach response requirements

Comply with electronic marketing rules (PECR)

Electronic marketing rules under PECR

Understand the consequences of non-compliance

Maintain ongoing compliance

Official guidance

Next steps

Growing your business

Start importing goods to the UK

Transfer ownership of your business

Related journeys

Data protection compliance checklist

Run a tech business

Understanding UK GDPR from scratch

Marketing compliance: PECR and UK GDPR