UK GDPR accountability checklist

The accountability obligations the UK GDPR places on a controller, each tied to the article it comes from. There is no GDPR certificate, so this is what "compliant" actually means in practice.

Read this first. This covers controller obligations. If you are a processor, Article 28 and Article 32 still apply to you directly, but much of the rest does not.

0 of 19

Know what you hold

Record of processing activitiesWhat you process, why, who you share it with, and how long you keep it. The first thing the ICO asks for.Article 30Lawful basis identified for each activityOne of the six. Chosen before processing starts, and documented.Article 6Special category conditions where relevantHealth, biometric and similar data need an Article 9 condition on top of the Article 6 basis.Article 9

Tell people

Privacy notice for data collected from the individualProvided at the point of collection, covering everything Article 13 lists.Article 13Privacy notice where data came from elsewhereIncluding the source, and normally within one month.Article 14Consent mechanism is genuinely freely givenWhere consent is your basis: unbundled, affirmative, and as easy to withdraw as to give.Article 7

Honour rights

A working process for data subject requestsOne month to respond, extendable by two for complex requests. A process that only one person knows is not a process.Articles 15 to 22Erasure and rectification can actually be performedIncluding in backups and with processors. Most organisations discover this gap during the first request.Articles 16 and 17Portability supported where applicableStructured, commonly used, machine-readable format, where processing is by consent or contract and automated.Article 20

Protect and govern

Security measures appropriate to the riskArticle 32 is deliberately outcome-based. Encryption, resilience, and regular testing are named.Article 32DPIA process for high-risk processingRequired before processing likely to result in high risk, not after.Article 35Data protection by design and by defaultBuilt into the decision, evidenced at the point the decision was made.Article 25DPO appointed if requiredMandatory for public authorities, large-scale monitoring, or large-scale special category processing.Article 37

Third parties and borders

Article 28 terms with every processorA contract with the specific terms Article 28(3) requires. A standard supplier agreement rarely contains them.Article 28International transfers have a valid mechanismAdequacy, the IDTA or Addendum, or another Chapter V safeguard, plus a transfer risk assessment.Chapter V

When it goes wrong

Breach detection and internal escalationYou cannot meet 72 hours if discovery itself takes a week.Article 33Regulator notification within 72 hoursTo the ICO, unless the breach is unlikely to result in a risk to individuals.Article 33Individual notification where risk is highWithout undue delay, in clear and plain language.Article 34Breach register maintainedAll breaches recorded, including those you decided not to report, with the reasoning.Article 33(5)

Your ticks stay in this browser tab and are not saved or sent anywhere. Refreshing clears them.

Keep reading

FrameworkUK GDPR: what it is and who assesses it

InsightGDPR compliance for SaaS companies

ToolWork out which frameworks apply to you

Ticked most of it and stuck on the rest?

UK GDPR is assessed by no certification. enforced by the ico or an eu supervisory authority. We run the programme up to that point and manage the assessment itself.

Book a free consultation