Compliance tools · Cybersecurity and data protection

UK GDPR and DPA 2018 compliance tool

Data Protection Act 2018 (c. 12) · United Kingdom · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your UK GDPR and DPA 2018 documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report

UK GDPR and DPA 2018 is Data Protection Act 2018 (c. 12), a binding instrument in the United Kingdom. Personal data obligations for businesses established in the UK and for those outside it that offer goods or services to, or monitor, people in the UK.

The free assessment screens for UK GDPR and DPA 2018 when a business handles personal data through a UK establishment or about people in the UK.

Screen your business against all 116 agent toolkits, free →

• Your exact position under UK GDPR and DPA 2018: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that UK GDPR and DPA 2018 applies to your business, free →

Does UK GDPR and DPA 2018 apply to my business?

The UK GDPR and DPA 2018 apply to you if you process personal data in the United Kingdom as a controller or processor, or if you are established outside the UK and offer goods or services to people in the UK or monitor their behaviour. The UK GDPR applies by virtue of Article 3 UK GDPR as retained in UK law by the European Union (Withdrawal) Act 2018 s.3.

Who does UK GDPR and DPA 2018 apply to?

It applies to any controller or processor processing personal data in the United Kingdom, including competent authorities processing for law enforcement purposes under Part 3 and intelligence services processing under Part 4. Other processing under the Act must be carried out in the context of the activities of an establishment in the United Kingdom (s.207).

Does UK GDPR and DPA 2018 apply to a small business?

The Act has no size threshold. It applies to all organisations processing personal data and there is no SME carve-out, so SMEs acting as controllers or processors are fully subject to the UK GDPR (Part 2) and, where acting as competent authorities, to Part 3.

When does UK GDPR and DPA 2018 apply from, and what are the deadlines?

The Act received Royal Assent on 23 May 2018 and its primary commencement was 25 May 2018. Deadlines include 72 hours for breach notification to the Commissioner in law enforcement processing (s.67(1)(b)), one month for a law enforcement access request response extendable by two further months (s.54(2), s.54(3A)-(3B)), and 30 days for controller acknowledgement of a data subject complaint (s.164A(3)).

What does UK GDPR and DPA 2018 require me to do?

You must have a lawful basis for processing (s.2), keep records of processing activities (s.61), maintain logs of automated processing covering collection, alteration, consultation, disclosure, combination and erasure (s.62), and carry out a data protection impact assessment before high risk processing (s.64). Competent authority controllers must designate a data protection officer unless a court or judicial authority acting in its judicial capacity (s.69(1)).

What records or documents does UK GDPR and DPA 2018 require me to keep or produce?

Controllers and processors must maintain records of all categories of processing activities (s.61), including controller identity, purposes, categories of recipients, categories of data subjects and personal data, third-country transfers, legal basis and envisaged erasure time limits. Controllers processing special category or criminal offence data under Schedule 1 must produce and maintain an appropriate policy document (Sch.1 para.39) and make it available to the Commissioner on request without charge (Sch.1 para.40).

What happens if I do not comply with UK GDPR and DPA 2018?

The Information Commissioner (s.114) may impose a higher maximum penalty of GBP 17,500,000 or 4 per cent of total annual worldwide turnover, whichever is higher, for infringements of data protection principles, data subject rights and international transfer provisions, and a standard maximum of GBP 8,700,000 or 2 per cent, whichever is higher, for controller or processor obligation infringements. Criminal offences include unlawful obtaining or disclosure of personal data (s.170) and re-identification of de-identified personal data (s.171).

How is UK GDPR and DPA 2018 different from DUAA 2025?

The Data (Use and Access) Act 2025 (c. 18) is the principal amending Act, making substantial amendments to the DPA 2018 including new provisions on automated decision-making (ss.50A-50D), codes of conduct (s.71A), transfer adequacy (ss.74AA, 74AB) and the Information Commission (s.114A, Sch. 12A).

How do I start complying with UK GDPR and DPA 2018?

The first practical step is to establish your lawful basis for processing (s.2) and your controller designation (s.6). Competent authority controllers must then designate a data protection officer unless a court or judicial authority acting in its judicial capacity (s.69(1)).

Which ComplianceSME account includes the UK GDPR and DPA 2018 toolkit?

The UK GDPR and DPA 2018 agent toolkit is free with the Start account.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive