GDPR compliance checklist for UK SMEs

This GDPR compliance checklist for UK businesses helps you turn privacy obligations into work that has an owner and evidence of completion. Start with one real process, such as taking a customer enquiry, and trace the information through your systems. A policy document cannot tell you whether staff actually follow it.

UK GDPR governs the use of personal information alongside the Data Protection Act 2018 and subsequent amendments, including the Data (Use and Access) Act 2025. The ICO's scope guidance covers organisations operating in the UK and certain overseas processing. Someone's citizenship or residence alone does not determine every obligation. Check scope separately for cross-border activities.

This is a practical review for an SME that handles customer, employee or supplier information. It is not a certificate of compliance. Use current ICO guidance for the detail, especially where a new product, sensitive information or an international operation changes the assessment.

Start with the principles and accountability

The principles concern lawful, fair and transparent use; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. Accountability means taking responsibility and being able to demonstrate compliance. A completed checklist should therefore point to records and observed practice, not just a series of ticks.

For each process, record why you need the information, who can access it, who receives it, how long it is kept and who makes decisions about it. Distinguish a controller, which determines purposes and means, from a processor acting on a controller's behalf. Your obligations can differ by role, even within the same business.

1. Identify the purpose and lawful basis

The ICO's current lawful-basis guide identifies seven bases: consent, contract, legal obligation, vital interests, public task, recognised legitimate interest and legitimate interests. Choose and document the applicable basis before processing. A basis that fits one purpose does not automatically cover another.

Recognised legitimate interest is limited to specified purposes; it is not a general exemption for useful commercial activity. Ordinary legitimate interests requires assessment of necessity and the balance with people's interests and rights. Consent must be meaningful and withdrawable where relied upon.

Special category information needs an additional condition as well as a lawful basis. Criminal offence information has separate additional rules. Do not list criminal records as a special category or assume that a general consent tickbox settles either assessment.

Your evidence should state the purpose, basis, reasons and any additional condition. If you cannot explain why a field is necessary, remove it or change the process before collecting it.

2. Map information and keep appropriate records

Trace information through forms, inboxes, spreadsheets, cloud services, paper records and suppliers. Include exports and shared folders. Ask the people who do the work to demonstrate the process; an application list alone misses manual copies.

Under Article 30 documentation guidance, organisations with fewer than 250 employees have a limited exemption. They still need to record processing that is not occasional, risks people's rights and freedoms, or involves special category or criminal offence information. Routine payroll is not occasional simply because it runs once a month.

Use the relevant controller or processor record template. Keep it current when a process changes. Link the record to privacy information, contracts, retention decisions and security controls so that a reviewer can follow the evidence.

3. Give people usable privacy information

Explain who you are, what you do with the information, the purposes and lawful bases, recipients, retention, relevant rights and contact routes. The ICO's individual-rights guidance includes the right to be informed.

Put the explanation where people need it. A job applicant and a newsletter subscriber may need different information. Check the applicable timing rules when information comes directly from someone or from another source. A general website notice is not evidence that every process has been explained.

Test a form on paper or in a safe development environment. Can a reader understand the purpose before entering information? Does the notice match the fields and actual recipients? Repair the process and the notice together if they disagree.

4. Make rights requests recognisable and manageable

Cover the right to be informed, access, rectification, erasure, restriction, portability, objection, and protections around automated decision-making. These rights have conditions and exceptions. For example, erasure is not an unconditional instruction to delete information you must lawfully retain, and portability does not apply to every record.

A subject access request can be verbal or written and does not need to mention GDPR. The ICO's SAR guide requires a response without undue delay and normally within one month. It explains permitted extensions, identity checks and reasonably required clarification. Do not use clarification to force someone to narrow a request or delay routine work.

Assign an owner, record receipt and the applicable deadline, make a reasonable and proportionate search, assess third-party information and exemptions, and provide the response securely. If automated systems make significant decisions about people, assess the applicable safeguards and human-review arrangements using the ICO's detailed guidance before deployment.

5. Decide whether you need a DPO

A formal DPO is required for relevant public authorities or bodies, and where core activities meet the large-scale monitoring or sensitive-data tests described in the ICO's DPO guidance. Criminal offence information and special category information are separate categories within that assessment.

Document the decision using your actual processing. If a DPO is not mandatory, assign a competent privacy coordinator with time and access to advice. If you appoint a DPO voluntarily, the formal role requirements still apply. Our DPO requirements guide explains the decision and conflicts to check.

6. Match security measures to the risk

Review access, authentication, patching, encryption, backups, logging and supplier controls. Choose measures proportionate to the information and the harm that misuse or loss could cause. These are controls to assess, not a claim that every technology is an identical statutory requirement for every business.

Test what matters. Can a former employee still access a customer folder? Can you restore a needed record? Does a shared account prevent you from establishing who changed information? Assign each failure to an owner and repeat the test after repair.

Cyber Essentials can support baseline technical security. It does not establish that lawful basis, transparency, rights handling or every data-protection obligation has been met.

7. Check processors and international access

Identify which suppliers act as processors and confirm the required contractual terms and sufficient guarantees. Read what the agreement covers, including subprocessors, security, assistance, incident reporting, return or deletion and audit information. A provider's logo or a checked procurement box does not establish the terms.

Use the ICO's restricted-transfer test when information is sent or made accessible abroad. The test considers whether UK GDPR applies, whether you initiate the transfer, and whether the overseas recipient is a separate legal entity.

Where a restricted transfer occurs, establish a valid mechanism: applicable UK adequacy regulations, appropriate safeguards with the required transfer assessment, or an applicable exception. An IDTA is one possible safeguard, not a universal answer. Do not proceed if no permitted mechanism covers the transfer. Keep your data map and contracts aligned with the result.

8. Prepare for breaches and high-risk projects

The ICO's breach guide requires notification unless a personal data breach is unlikely to risk people's rights and freedoms. Notify without undue delay and, where feasible, within 72 hours of awareness. If the risk is high, inform affected people without undue delay. Record every breach and the reasoning, including decisions not to notify. A processor must notify its controller without undue delay.

Contain the incident and preserve evidence while assessing notification. You can supply missing details in phases without undue further delay; waiting for a complete investigation is not a reason to ignore the deadline.

For proposed processing likely to create high risk, complete a DPIA before starting. Involve the DPO if you have one, document mitigations and address any requirement for prior ICO consultation where high residual risk remains. The project owner must know what decision is needed before launch.

A completed review of one process

Consider a fictional consultancy's enquiry form. Its review finds that messages go into a CRM and a shared inbox, while an old spreadsheet retains copies indefinitely. The stated purpose is responding to enquiries, but the form also asks for information the team never uses.

The owner removes unnecessary fields, records the appropriate lawful basis, updates the privacy information to match the CRM and inbox, and checks the processor terms. They define a justified retention rule and implement it across all three locations. They then test retrieval with a fictional record and confirm who handles a rights request.

The outcome is an assigned, tested process with fewer unnecessary copies. It is not a claim that the whole organisation is compliant. The next review follows another process, such as recruitment, whose information and risks may require different decisions.

Turn findings into an action list

Keep a short register of each gap, its risk to people, owner, due date and evidence needed to close it. Prioritise unsafe access, uncontrolled sharing and missed rights or breach deadlines. Training should use the actual reporting route and tasks staff perform, with refreshes when processes or risks change.

The IT governance guide explains how to keep these responsibilities visible to management. Our IT compliance service can help connect the data map, supplier evidence and technical controls. Arrange a consultation with one process you cannot currently explain or verify, and use it to define the first practical repair.