A practical resource for UK organisations
Make sense of UK data protection. Find the right guidance, review your evidence and build a plan you can put to work.
YOUR NEXT MOVE
Work through ten connected areas. Record what you can evidence, identify the gaps and decide who does what next.
YOUR NEXT MOVE
Follow a new system or supplier from its purpose and data flows through screening, safeguards and a recorded launch decision.
YOUR NEXT MOVE
Use the relevant playbook to organise responsibilities, preserve the evidence and manage the decisions that matter.
START WITH THE WORK
Choose the job you need to get done.
Follow it through to a useful record.
A structured review of governance, people, systems and suppliers.
Work through risk screening, suppliers and launch decisions.
Organise recognition, searches, redaction and the response.
Contain the incident, assess the risk and record the decisions.
THE CONNECTED FRAMEWORK
Follow the obligation through to the evidence, the decision and the record. Each guide connects to its own assessment area and working document.
Explore the guidanceGovernance, evidence and a prioritised plan
High-risk processing, mitigations and approval
A working record of what happens to data
Purpose-by-purpose decisions and clear notices
Justified periods, deletion and legal holds
Overseas access, safeguards and transfer risk
Recognition, escalation and notification decisions
Searches, deadlines, redaction and exemptions
Roles, independence and registration checks
Tags, consent, exceptions and marketing lists
FROM GUIDANCE TO EVIDENCE
Use the spreadsheet registers for ongoing records. Use the guided documents for a decision, review or response. Save a working copy and return when you have the next piece of evidence.
THE CONTEXT MATTERS
Patient information, clinical systems and sensitive data.
Your evidence starter packClient confidentiality, case files and professional duties.
Your evidence starter packRecruitment, employee records and monitoring.
Your evidence starter packProportionate controls for everyday processing.
Your evidence starter packNEWS & IMPLEMENTATION
The DUAA controller complaints requirements commenced on 19 June 2026. Facilitate complaints, acknowledge them within 30 days, make appropriate enquiries, keep the person informed and communicate the outcome without undue delay.
Read the briefingThe ICO finalised its storage and access technologies guidance on 29 April 2026. Limited statistical and appearance uses can qualify for an exception, with conditions including transparency and a simple free objection route.
Read the briefingMost remaining data protection and privacy reforms commenced on 5 February 2026. Review lawful-basis, SAR, transfer and PECR procedures against the amended rules, rather than treating DUAA as a future proposal.
Read the briefingA BETTER NEXT STEP
Start with one area or work through the full review. Your report makes the evidence, uncertainties and priorities visible.