YOUR WORKING OUTCOME
Build a manageable set of records around customers, staff, suppliers and the website, then test the basics.
Where to begin
Begin with the information you use to deliver the service. A proportionate review can start small while still identifying sensitive processing, important supplier dependencies and urgent gaps.
Sole traders, owners, office managers and small teams responsible for everyday customer and worker information.
Your first working session
Name the person who will coordinate the work
Assign a practical owner and a deputy contact for requests and incidents. Assess DPO and fee duties separately.
Bring back: A short responsibilities record with contact routes.
Map your main information flows
List customers, staff, payments, website enquiries and suppliers. Record categories of information rather than real customer details.
Bring back: A systems and purposes inventory.
Check one real process
Follow an enquiry or completed order through the systems and compare it with the notice and retention rule.
Bring back: A recorded walkthrough with specific discrepancies.
Work through the evidence
Make the information inventory usable
Record what you collect, why, who can access it, which suppliers receive it and when it should be removed. Include phones, messaging, shared spreadsheets and paper. Review Article 30 applicability by activity instead of assuming small size creates an exemption.
Evidence: Forms, software list, shared-folder review and staff walkthrough.Your output: A short ROPA and data-flow record with named owners.What useful evidence might look like
Illustrative: FLOW-01 records that website enquiries are copied into both a mailbox and a sales spreadsheet.
ICO: getting started with data protection (opens in a new tab) · ICO: accountability and governance (opens in a new tab)
Align the purpose, basis and explanation
Document the basis for each use and collect only the information needed. Compare the notice with the actual enquiry, booking or purchase journey. Keep service communications and optional marketing purposes clear.
Evidence: Purpose and basis records, form fields and the information shown to customers.Your output: A corrected collection journey and privacy notice checklist.What useful evidence might look like
Illustrative: NOTICE-02 removes an unused date-of-birth field and records the form version.
ICO: current guide to lawful basis (opens in a new tab) · ICO: getting started with data protection (opens in a new tab)
Verify access and critical suppliers
Review access to email, shared files, customer records and finance tools. Check leaver access and proportionate recovery arrangements. For suppliers, identify the legal entity, role, relevant contract, support location and transfer route.
Evidence: User list, access checks, recovery evidence and supplier documents.Your output: A prioritised control list with an owner and verification method.What useful evidence might look like
Illustrative: ACTION-06 is closed only when the old shared login has been replaced and access checked.
ICO: controller responsibilities when using a processor (opens in a new tab) · ICO: required processor contract terms (opens in a new tab) · ICO: international transfer test (opens in a new tab)
Review the website and marketing list
Inventory actual cookies and tags using an authorised technical check. Verify the permission route for each audience and channel, the collection context and the opt-out. Test that unsubscribed contacts remain suppressed after an import.
Evidence: Browser inspection evidence, list provenance, consent or soft-opt-in records and an unsubscribe test.Your output: A cookie and marketing action record tied to observed behaviour.What useful evidence might look like
Illustrative: TEST-03 records that an optional tag stays inactive after rejection.
ICO: storage and access technologies (opens in a new tab) · ICO: direct marketing by electronic mail (opens in a new tab)
Make rights, complaints and incidents recognisable
Give the team a simple route for passing requests, complaints and suspected breaches to the responsible person. Test a request through the normal customer channel and an incident outside normal hours. Keep the decisions in the correct logs.
Evidence: Contact routes, sample request, incident exercise and staff briefing.Your output: A working escalation process with a deputy and identified gaps.SAR search and redaction record ↗Breach decision and notification record ↗Complaints procedure briefing ↗What useful evidence might look like
Illustrative: EX-01 records that a verbal request is logged and passed to the privacy owner on receipt.
ICO: guide to subject access (opens in a new tab) · ICO: personal data breaches guide (opens in a new tab) · ICO: accountability and governance (opens in a new tab)
Review retention, fee and completion evidence
Set justified retention rules by record type and test one disposal path. Check the current ICO fee assessment and record the outcome. Use the gap report to track evidence, owners and practical target dates; keep legal deadlines distinct.
Evidence: Schedule, disposal test, fee decision and action log.Your output: A small, maintainable evidence pack and a plan for unresolved work.What useful evidence might look like
Illustrative: REVIEW-01 links each closed action to a dated document, setting or completed test.
ICO: storage limitation (opens in a new tab) · ICO: data protection fee (opens in a new tab) · ICO: accountability and governance (opens in a new tab)
Your completed starter pack
- Named responsibilities and fee decision
- Main activities and supplier inventory
- Basis and notice review
- Website and marketing evidence
- Rights, complaints and incident routes
- Retention schedule and owned improvement plan
When to escalate
- Move sensitive-data, intrusive monitoring or other potentially high-risk activities into the relevant specialist review rather than treating them as routine administration.
- Do not wait for the full review to finish before acting on a live incident or an approaching rights deadline.
- Treat a supplier's claim of GDPR compliance as a starting point for relevant evidence, not a substitute for reviewing the actual arrangement.
- Record why an activity is not applicable. Missing information should remain visible as an open question.
Give the open actions an owner.
Use the assessment to organise your findings, then verify the underlying evidence before reporting assurance.
Start your reviewOfficial sources
- ICO: getting started with data protection (opens in a new tab)
- ICO: accountability and governance (opens in a new tab)
- ICO: current guide to lawful basis (opens in a new tab)
- ICO: controller responsibilities when using a processor (opens in a new tab)
- ICO: required processor contract terms (opens in a new tab)
- ICO: international transfer test (opens in a new tab)
- ICO: storage and access technologies (opens in a new tab)
- ICO: direct marketing by electronic mail (opens in a new tab)
- ICO: guide to subject access (opens in a new tab)
- ICO: personal data breaches guide (opens in a new tab)
- ICO: storage limitation (opens in a new tab)
- ICO: data protection fee (opens in a new tab)