Read the primary material
Each guide links to the relevant official sources. The source date for this edition is 1 November 2026. Links do not imply endorsement. Where law has been amended, check the current text, commencement and transitional provisions.
Current regulator terminology
The legal regulator became the Information Commission on 30 September 2026. Its public-facing organisation continues to be known as the ICO, now the Information Commission’s Office.
Compliance gap audit
- ICO — Guide to accountability and governance (opens in a new tab)
- ICO — Leadership and oversight (opens in a new tab)
- ICO — Policies and procedures (opens in a new tab)
- ICO — Training and awareness (opens in a new tab)
- ICO — Controller-processor contract terms (opens in a new tab)
Data protection impact assessments
- ICO — When do we need to do a DPIA? (opens in a new tab)
- ICO — DPIA overview and prior consultation (opens in a new tab)
- ICO — DPIA audit controls (opens in a new tab)
Records of processing
- ICO — Documentation (opens in a new tab)
- ICO — Who needs to document processing? (opens in a new tab)
Lawful basis & privacy notices
- ICO — A guide to lawful basis (seven bases) (opens in a new tab)
- ICO — Recognised legitimate interest (opens in a new tab)
- ICO — Rules on special-category data (opens in a new tab)
- ICO — Substantial public interest and APDs (opens in a new tab)
- ICO — Privacy information checklist (opens in a new tab)
- ICO — When to provide privacy information (opens in a new tab)
Retention & deletion
- ICO — Storage limitation (opens in a new tab)
- Limitation Act 1980, section 5 (opens in a new tab)
- Limitation Act 1980, section 8 (opens in a new tab)
- GOV.UK — Company and accounting records (opens in a new tab)
- NHS England — Care records retention schedule (opens in a new tab)
- SRA — Accounts Rules, Rule 13 (opens in a new tab)
- SRA — Closing down your practice, retention (opens in a new tab)
- Faculty Office — Notaries Practice Rules 2019, Rule 24 (opens in a new tab)
International transfers
- ICO: What is an international transfer? (opens in a new tab)
- ICO: Adequacy coverage (opens in a new tab)
- ICO: UK Extension to the EU–US DPF (opens in a new tab)
- ICO: Meeting the transfer rules and data protection test (opens in a new tab)
- ICO: UK IDTA and Addendum (opens in a new tab)
- DUAA commencement regulations: SI 2026/82 (opens in a new tab)
Breach response
- ICO: Personal data breaches guide (opens in a new tab)
- UK GDPR Article 33 (opens in a new tab)
- UK GDPR Article 34 (opens in a new tab)
Subject access requests
- ICO: A guide to subject access (opens in a new tab)
- ICO: Responding to a request and clarification (opens in a new tab)
- ICO: Finding and retrieving information (opens in a new tab)
- ICO: Third-party information in SARs (opens in a new tab)
- ICO: Data protection exemptions, including health data (opens in a new tab)
- DPA Schedule 2 paragraph 16 (opens in a new tab)
- DUAA section 78: proportionate searches and retrospective effect (opens in a new tab)
DPO & ICO fee
- ICO: Data protection officers (opens in a new tab)
- ICO: Guide to the data protection fee (opens in a new tab)
- ICO: Fee exemptions (opens in a new tab)
- ICO: Fixed non-payment penalties (opens in a new tab)
- ICO: Receiving information from the EEA and territorial scope (opens in a new tab)
Cookies & direct marketing
- ICO: Storage and access technologies guidance (opens in a new tab)
- ICO: Storage and access exceptions (opens in a new tab)
- ICO: Direct marketing by electronic mail (opens in a new tab)
- ICO: Plan direct marketing (opens in a new tab)
- ICO: Telephone marketing (opens in a new tab)
- ICO: DUAA commencement statement (opens in a new tab)
DUAA commencement and recent updates
- DUAA: core data protection reforms are in force (opens in a new tab)
- A complaints procedure now belongs in your accountability framework (opens in a new tab)
- New cookie exceptions need a purpose-by-purpose assessment (opens in a new tab)
- Information Commission: new legal body, continuing ICO services (opens in a new tab)
- Charitable marketing has a distinct soft opt-in route (opens in a new tab)