GDPR and UK GDPR Compliance, Tracked and Mapped to Your Policies

Lawful basis and the data protection principles

Every processing activity needs a lawful basis under Article 6 (consent, contract, legal obligation, vital interests, public task or legitimate interests), with extra conditions under Article 9 for special-category data. Processing must also satisfy the Article 5 principles, including purpose limitation, data minimisation, accuracy and accountability.

Data subject rights

Individuals can exercise rights of access, rectification, erasure, restriction, portability and objection (Arts 12 to 22), generally within one month. The UK regime is moving to a 'reasonable and proportionate' search standard and a 'stop the clock' rule for clarifying requests under the Data (Use and Access) Act 2025.

Records of Processing Activities (RoPA, Art 30)

Controllers and processors must maintain written records of their processing activities, covering purposes, categories of data and data subjects, recipients, transfers, retention and security measures. This RoPA is the backbone an auditor or regulator will ask for first.

Security of processing (Art 32)

Implement appropriate technical and organisational measures proportionate to the risk, such as encryption, pseudonymisation, resilience and a process for regularly testing and evaluating those controls.

Personal data breach notification (Arts 33 and 34)

Notify the supervisory authority (the ICO in the UK) without undue delay and, where feasible, within 72 hours of becoming aware of a breach likely to risk individuals' rights, and notify affected individuals directly where the risk is high.

Data Protection Impact Assessments (DPIA, Art 35)

Carry out a DPIA before processing that is likely to result in a high risk to individuals, for example large-scale special-category processing, systematic monitoring or new technologies, and consult the supervisory authority where residual high risk remains (Art 36).

Accountability, transfers and governance

Demonstrate compliance through documented policies, privacy notices (Arts 13 and 14), processor contracts (Art 28), a lawful transfer mechanism for international transfers (Chapter V), and, where required, a Data Protection Officer (Art 37).

Weekly-monitors the regulators and legislative trackers that touch you (including the ICO, EU bodies and the Data (Use and Access) Act 2025 commencement timeline) and drafts a source-linked digest of what changed. Where a change hits a policy you have published, it produces a DOCX redline in track changes for your counsel to review.

Scores your uploaded privacy notice, data protection policy, RoPA and related documents against the GDPR and UK GDPR corpus, showing exactly which obligations are covered, partial or missing with an overall gap score, so you can prioritise remediation.

Gives you the registers GDPR expects in one place: a RoPA / processing-activities register, a risk register with a 5x5 matrix, a controls library, incidents, DPIAs, cookies, assets and vendors, plus a review and approval workflow, tickets and dashboards.

Scores vendor and third-party risk for your processors and sub-processors and reconciles your published privacy notice against what your registers actually record, surfacing mismatches before an auditor or data subject does.

Builds your compliance profile by crawling your website and classifying the policies it finds, then hands it to your counsel to review and edit, so your GDPR programme starts from an accurate picture of what you have published.