Find the next useful resource
Search UK GDPR guidance and templates.
Search the guides, tools and working documents together. Try a legal term, an acronym or the task in front of you.
Find a guide, tool or working document
Use more than one word to narrow your results.
UK GDPR guidance library
Ten source-linked guides covering UK GDPR accountability, DPIAs, ROPA, lawful basis, retention, transfers, breaches, SARs, DPOs and PECR.
Open resource GUIDANCEUK GDPR compliance gap audit
Build a defensible picture of your data-protection controls. Compare the policies you hold with the work people actually do, then turn the gaps into an owned, prioritised plan.
Open resource GUIDANCEData Protection Impact Assessment
Identify risks to people before a project starts. Record why processing is necessary, how risks will be reduced and who accepts the remaining risk.
Open resource GUIDANCERecord of Processing Activities review
Keep one maintainable view of what personal information your organisation uses, why it uses it, where it goes and when it should be deleted.
Open resource GUIDANCELawful basis and privacy notice review
Match each purpose to a valid legal basis and explain it clearly to the people affected. Test what happens in practice against what your notices promise.
Open resource GUIDANCEData retention and deletion schedule review
Set justified retention periods by record type, then make deletion work across systems, suppliers and backups while preserving information subject to a valid legal hold.
Open resource GUIDANCEInternational transfers & transfer risk assessment
Trace overseas hosting, suppliers and remote support. Record the transfer route, test the safeguards and resolve gaps before data moves.
Open resource GUIDANCEBreach response & regulatory notification
Know who acts, when to escalate and what evidence to preserve. Test a response plan before an incident becomes a deadline.
Open resource GUIDANCESubject access request handling audit
Follow a request from first contact to secure disclosure, with a defensible search, proportionate identity checks and a clear exemption record.
Open resource GUIDANCEDPO, representative & ICO fee review
Keep three decisions distinct: whether a DPO is required, whether a territorial representative is needed and whether the data protection fee is payable.
Open resource GUIDANCECookies & direct marketing compliance
Connect the banner, tags and marketing lists to the rules that actually apply. Test both what the interface says and what the technology does.
Open resource TOOL & RESOURCEUK GDPR compliance reviews & gap audits
Ten connected compliance reviews with evidence checklists, practical deliverables and a free 50-question browser-only gap assessment.
Open resource TOOL & RESOURCEFree UK GDPR gap assessment & action plan
A browser-only 50-question UK GDPR self-assessment with evidence references, RAG findings, action owners, CSV export and a printable board report.
Open resource TOOL & RESOURCEHow the GDPR gap assessment works
Understand evidence requirements, RAG ratings, assessment limitations, privacy, exports and suggested remediation priorities.
Open resource TOOL & RESOURCEDPIA screening tool and saveable decision record
Screen UK GDPR high-risk indicators, record a reasoned decision, save and reopen a working copy, and print the screening record.
Open resource TOOL & RESOURCEPractical UK GDPR tools
Free browser-only GDPR gap assessment, DPIA screening and downloadable working records.
Open resource SECTOR ROUTEUK GDPR guidance by sector
Practical sector routes for clinics, legal and notarial practices, HR teams and small businesses.
Open resource SECTOR ROUTEClinics & healthcare — UK GDPR implementation route
Trace a patient journey, check access and suppliers, and assemble a defensible clinical-information evidence pack.
Open resource SECTOR ROUTELegal & notarial practices — UK GDPR implementation route
Connect matter handling, professional confidentiality, supplier access and record duties in one controlled review.
Open resource SECTOR ROUTEEmployers & HR teams — UK GDPR implementation route
Follow the worker lifecycle and control who sees recruitment, pay, health and monitoring information.
Open resource SECTOR ROUTESmall businesses & service teams — UK GDPR implementation route
Build a manageable set of records around customers, staff, suppliers and the website, then test the basics.
Open resource PLAYBOOKUK GDPR implementation playbooks
Step-by-step workflows for new systems and suppliers, rights requests and suspected data breaches.
Open resource PLAYBOOKBefore a new system or supplier goes live — UK GDPR playbook
Turn a product proposal into a documented decision about data, suppliers, risks and the controls that must work.
Open resource PLAYBOOKA person asks for their information and deletion — UK GDPR playbook
Recognise each right, calculate the correct timetable, search and review, then explain the decision clearly.
Open resource PLAYBOOKA suspected personal data breach is reported — UK GDPR playbook
Contain the incident, establish the facts and awareness, and make separate, recorded notification decisions.
Open resource BRIEFINGUK GDPR news, legal changes & implementation
Source-linked UK data protection briefings, DUAA reforms and practical implementation guidance with clear event and publication dates.
Open resource BRIEFINGDUAA: core data protection reforms are in force
Most remaining data protection and privacy reforms commenced on 5 February 2026. Review lawful-basis, SAR, transfer and PECR procedures against the amended rules, rather than treating DUAA as a future proposal.
Open resource BRIEFINGA complaints procedure now belongs in your accountability framework
The DUAA controller complaints requirements commenced on 19 June 2026. Facilitate complaints, acknowledge them within 30 days, make appropriate enquiries, keep the person informed and communicate the outcome without undue delay.
Open resource BRIEFINGNew cookie exceptions need a purpose-by-purpose assessment
The ICO finalised its storage and access technologies guidance on 29 April 2026. Limited statistical and appearance uses can qualify for an exception, with conditions including transparency and a simple free objection route.
Open resource BRIEFINGInformation Commission: new legal body, continuing ICO services
The Information Commission assumed the regulator’s functions on 30 September 2026. The organisation continues to use the ICO name as the Information Commission’s Office. Its core guidance, regulatory responsibilities and public services continue.
Open resource BRIEFINGCharitable marketing has a distinct soft opt-in route
The ICO’s updated electronic-mail guidance explains the charitable-purposes soft opt-in. Eligible charities must satisfy its own conditions; permission cannot be assumed merely because a message supports a good cause.
Open resource TOOL & RESOURCEUK GDPR templates, ROPA & compliance registers
Download an Excel workbook and ten resumable working documents for DPIAs, audits, retention, transfers, breaches, SARs and PECR.
Open resource TOOL & RESOURCEAbout GDPR.me.uk & editorial standards
Independent UK data protection guidance with visible sources, practical tools and clear professional boundaries.
Open resource TOOL & RESOURCEOfficial UK data protection sources
Official ICO guidance, UK legislation and sector sources supporting the GDPR.me.uk reviews and templates.
Open resource WORKING DOCUMENTUK GDPR gap audit: evidence plan and board summary
Use this working document to organise a proportionate review of actual controls. Complete the evidence and sampling fields before assigning findings. A completed self-assessment is not independent assurance or an ICO certification.
Open resource WORKING DOCUMENTDPIA: processing, risks, mitigation and sign-off
Complete this assessment before introducing or materially changing processing that is likely to create a high risk. Apply the ICO screening criteria and their conditions. Record risks to people as well as delivery risks to the organisation.
Open resource WORKING DOCUMENTROPA and data-flow mapping worksheet
Use one activity record for each coherent processing purpose and maintain separate controller and processor records where both roles apply. Reconcile the records with actual systems and supplier arrangements.
Open resource WORKING DOCUMENTLawful basis, LIA and privacy notice review
Complete the basis decision for each purpose before drafting notices. Use the LIA section for ordinary legitimate interests; recognised legitimate interest is a separate, restricted statutory basis.
Open resource WORKING DOCUMENTRetention, deletion and legal-hold protocol
Set a reasoned schedule by record class, with a clear trigger and disposal method. Distinguish legal minimum periods, regulatory guidance, limitation considerations and the organisation’s own justified policy.
Open resource WORKING DOCUMENTInternational transfer decision and TRA worksheet
Follow the actual legal entities and access arrangements, then identify the transfer route and evidence needed. Use the official IDTA or Addendum where appropriate; this worksheet is not a transfer contract.
Open resource WORKING DOCUMENTBreach decision, notification and response record
Open this record as soon as an incident is identified. Log facts, timestamps, decisions and actions as they become known. Use a real incident response lead; a worksheet cannot monitor or submit a notification for you.
Open resource WORKING DOCUMENTSAR search, redaction and disclosure decision record
Use this record from initial receipt to final response. A request can arrive verbally or through any normal contact channel. Keep a reasoned, proportionate search and disclosure record.
Open resource WORKING DOCUMENTDPO necessity, representative and fee decision memo
Make three separate decisions: DPO requirement, territorial representative requirement and annual data protection fee. A fee registration is not a compliance certificate.
Open resource WORKING DOCUMENTCookie, tag and marketing audit workbook
Combine a permissions review with observed browser and campaign behaviour. Use a controlled test environment or an authorised inspection of the relevant website. Record findings rather than assuming a banner’s appearance proves compliance.
Open resource