GDPR Compliance Guide: A Step-by-Step Checklist for EU and UK Organisations

Last updated: 22 October 2026

Quick answer: GDPR compliance means being able to show that every use of personal data in your organisation follows the seven principles in Article 5 and has a lawful basis. In practice that means a repeatable programme: map your data, document lawful bases, publish privacy notices, answer requests within one month, run DPIAs, secure the data, manage processors and transfers, report qualifying breaches within 72 hours, appoint a DPO where required and keep evidence. The same steps apply under the EU GDPR and the UK GDPR, with a few UK-specific differences.

The General Data Protection Regulation (EU) 2016/679 has applied since 25 May 2018. After Brexit the UK kept an almost identical copy, the UK GDPR, which sits alongside the Data Protection Act 2018. Many organisations have to comply with both at once.

The regulation is principles-based. It rarely prescribes a specific tool or control, but it does require you to demonstrate compliance, and most enforcement problems come from gaps in that evidence.

This guide is for DPOs, compliance leads and CISOs who need a practical starting point: scope, principles, a 12-step programme, UK and EU differences, fines, a checklist and common questions, with links to more detailed guides.

What is GDPR and who does it apply to?

GDPR is the EU law that governs how organisations collect, use, store and share personal data about living individuals. It applies to organisations established in the EU and, under Article 3, to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there.

Article 3 sets out the territorial scope in two parts:

• Establishment (Article 3(1)): processing in the context of an EU establishment of a controller or processor, wherever the processing takes place.
• Targeting (Article 3(2)): it also applies to controllers and processors with no EU establishment where they process personal data of people in the EU in connection with offering them goods or services (paid or free) or monitoring their behaviour in the EU, for example through tracking or profiling.

Non-EU organisations caught by Article 3(2) generally need to appoint a representative in the EU under Article 27. The UK GDPR mirrors this: an organisation outside the UK that targets or monitors people in the UK may need a UK representative.

Controllers and processors

Your obligations depend on your role in each processing activity:

• Controller: decides why and how personal data is processed. Controllers carry most of the obligations, including choosing a lawful basis, informing individuals and answering their requests.
• Processor: processes personal data on behalf of a controller and only on its documented instructions, such as a payroll provider or cloud host. Processors have direct duties too, including security, records and breach notification to the controller.
• Joint controllers: two or more organisations that decide the purposes and means together. Article 26 requires an arrangement setting out their respective responsibilities.

UK GDPR and the Data Protection Act 2018

In the UK, the UK GDPR is the retained version of the EU text, adapted to work in a domestic context. The Data Protection Act 2018 (DPA 2018) supplements it with exemptions, conditions for special category and criminal offence data, and separate regimes for law enforcement and the intelligence services. The Information Commissioner’s Office (ICO) is the regulator. Both have since been amended by the Data (Use and Access) Act 2025, covered below.

What are the 7 GDPR principles?

Article 5 sets out six principles for processing personal data and a seventh, accountability, which requires you to be able to prove you follow the other six.

1. Lawfulness, fairness and transparency: have a lawful basis, do not use data in ways people would not reasonably expect, and tell them what you are doing.
2. Purpose limitation: collect data for specified, explicit and legitimate purposes and do not reuse it in incompatible ways.
3. Data minimisation: collect only what is adequate, relevant and limited to what is necessary.
4. Accuracy: keep data accurate and up to date, and correct or erase inaccurate data without delay.
5. Storage limitation: keep data in identifiable form no longer than necessary, which in practice means a retention schedule.
6. Integrity and confidentiality: protect data with appropriate technical and organisational security measures.
7. Accountability (Article 5(2)): the controller is responsible for, and must be able to demonstrate, compliance with the principles.

Accountability is what turns the principles into a programme. Article 24 requires appropriate measures to ensure and demonstrate compliance, and Article 25 requires data protection by design and by default. Regulators expect to see policies, records, assessments, contracts and training logs.

How do you comply with GDPR? A 12-step programme

The steps below follow the order most organisations work through in practice. Steps 1 and 2 are the foundation: almost everything else depends on knowing what data you hold and why.

1. Map your data and build a record of processing activities (Article 30)

Find out what personal data you hold, where it comes from, where it is stored, who it is shared with and how long it is kept. Interview process owners across departments and check systems and SaaS tools.

Article 30 turns this into a legal record. Controllers must record, among other things, the purposes of processing, the categories of data subjects and personal data, categories of recipients, international transfers and their safeguards, retention periods and a general description of security measures. Processors keep a shorter record of the processing they carry out for each controller.

There is a limited exemption for organisations with fewer than 250 employees, but it does not apply where processing is likely to result in a risk to individuals, is not occasional, or includes special category or criminal offence data. Most organisations process employee and customer data regularly, so in practice most need a record. Our GDPR ROPA guide explains the required fields and how to keep the record current.

2. Identify a lawful basis for each activity (Article 6) and special category conditions (Article 9)

Every processing activity needs one of the six lawful bases in Article 6(1):

• consent;
• contract (necessary to perform a contract with the individual or take steps before entering one);
• legal obligation;
• vital interests;
• public task;
• legitimate interests, which requires a legitimate interests assessment balancing your interests against the individual’s rights.

Choose the basis before processing starts and record it in your ROPA. Consent is not automatically the safest option: it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.

Special category data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data used for identification, health data, and data about sex life or sexual orientation) needs a lawful basis under Article 6 and a separate condition under Article 9. Criminal offence data is governed by Article 10. In the UK, many of the conditions are set out in Schedule 1 to the DPA 2018, and several require an appropriate policy document.

3. Write and publish privacy notices (Articles 13 and 14)

Individuals must be told how their data is used. Article 13 applies when you collect data directly from the person and requires the information at the time of collection. Article 14 applies when you obtain data from another source; you must provide the information within a reasonable period and at the latest within one month, or earlier if you contact the person or disclose the data to someone else.

A compliant notice covers who you are, DPO contact details, purposes and lawful bases, recipients, international transfers, retention periods, individuals’ rights (including withdrawing consent and complaining to a supervisory authority) and any automated decision-making. Keep it in plain language, with separate notices for customers, employees and applicants.

4. Set up a process for data subject rights and DSARs

GDPR gives individuals the rights of access, rectification, erasure, restriction, data portability and objection, and rights relating to automated decision-making (Articles 15 to 22). You need a way to recognise requests, verify identity, find the data, apply exemptions and respond on time.

The deadline under Article 12(3) is one month from receipt. It can be extended by a further two months where necessary, taking into account the complexity and number of requests, but you must tell the individual within the first month and explain why. Responses are normally free of charge. You can refuse or charge a reasonable fee only where a request is manifestly unfounded or excessive, and you must be able to justify that decision.

For the basics, see what a DSAR is and how to handle one. For deadlines across jurisdictions, including how the clock is calculated, see our guide to DSAR response times. Identity checks should be proportionate to the risk; our guide to DSAR identity verification explains how to avoid both over-disclosure and unnecessary barriers.

5. Carry out DPIAs for high-risk processing (Article 35)

A data protection impact assessment is mandatory where processing is likely to result in a high risk to individuals. Article 35(3) gives three examples: systematic and extensive profiling with significant effects, large-scale processing of special category or criminal offence data, and systematic monitoring of publicly accessible areas on a large scale. Supervisory authorities, including the ICO, publish lists of other processing that requires a DPIA.

A DPIA describes the processing, assesses necessity, proportionality and risks to individuals, and sets out mitigating measures, before processing starts. If high risk remains, consult the supervisory authority under Article 36. AI tools, employee monitoring and biometrics are frequent triggers. Our DPIA guide covers screening, the assessment itself and sign-off.

6. Implement appropriate security measures (Article 32)

Article 32 requires security appropriate to the risk, taking into account the state of the art, costs of implementation and the nature, scope, context and purposes of processing. It names measures such as pseudonymisation and encryption, the ability to ensure ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore access to data after an incident, and regular testing of the effectiveness of controls.

GDPR does not prescribe a standard. Many organisations map ISO 27001 controls to Article 32, covering access control, multi-factor authentication, encryption, logging, patching and backups.

7. Manage processors and put Article 28 contracts in place

Controllers may only use processors that provide sufficient guarantees of appropriate technical and organisational measures. Article 28(3) requires a binding contract (often called a data processing agreement) covering, among other things: processing only on documented instructions, staff confidentiality, Article 32 security, sub-processor conditions, assistance with rights requests, breaches and DPIAs, deletion or return of data at the end of the service, and audit rights.

Keep a register of vendors that handle personal data, assess them before onboarding and periodically after that, and link each one to the processing activities in your ROPA. A structured vendor risk assessment questionnaire keeps reviews consistent.

8. Control international transfers (Chapter V)

Transfers of personal data outside the EU (or, under the UK GDPR, outside the UK) are only allowed if one of the Chapter V mechanisms applies:

• Adequacy (Article 45): the destination has been found to provide an adequate level of protection. The EU-US Data Privacy Framework is an adequacy decision covering certified US organisations. The UK makes its own adequacy decisions, known as data bridges.
• Appropriate safeguards (Article 46): most commonly the European Commission’s standard contractual clauses (SCCs), or binding corporate rules for intra-group transfers. For UK transfers, the equivalent tools are the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.
• Derogations (Article 49): such as explicit consent or necessity for a contract. These are for occasional, specific situations, not routine transfers.

When relying on SCCs, the IDTA or the Addendum, document a transfer impact assessment (EU) or transfer risk assessment (UK) of the destination country’s law and practice. Our guide to the UK IDTA explains when to use the IDTA versus the Addendum.

9. Prepare for personal data breaches (Articles 33 and 34)

A personal data breach is a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, including misdirected emails and lost devices.

• Notify the supervisory authority (Article 33): without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individuals. If you notify later, you must give reasons for the delay. Information can be provided in phases.
• Notify individuals (Article 34): without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an exception applies, for example because the data was encrypted and the key was not compromised.
• Processors: must notify the controller without undue delay after becoming aware of a breach.
• Record every breach (Article 33(5)): including those you decide not to report, with the facts, effects and remedial action.

The 72-hour clock includes weekends, so write a data breach response plan and test it. For UK organisations, our guide to ICO breach reporting walks through the ICO’s process; reports are made through the ICO’s breach reporting page.

10. Appoint a data protection officer where required (Articles 37 to 39)

A DPO is mandatory where:

• you are a public authority or body (except courts acting in their judicial capacity);
• your core activities consist of processing operations that require regular and systematic monitoring of individuals on a large scale; or
• your core activities consist of large-scale processing of special category data or criminal offence data.

National law can extend this; Germany, for example, requires a DPO in additional cases. The DPO needs expert knowledge, must report to the highest management level, must not be instructed on their tasks and must not have a conflict of interest. The role can be internal or external. If you decide a DPO is not required, document why. See our page on the data protection officer role for how Enactia supports DPO work.

11. Train staff and assign responsibilities

Give all staff baseline training on recognising personal data and spotting a DSAR or a breach, with role-specific training for HR, marketing, customer service and IT. Keep training records. Name owners for each processing activity, system and policy so the programme does not rest on the DPO alone.

12. Monitor, audit and keep evidence

New suppliers, systems and laws change your position constantly. Build a cycle of:

• periodic reviews of the ROPA, privacy notices and retention schedule;
• internal compliance assessments against GDPR requirements, with findings tracked to closure;
• re-assessment of vendors and transfer safeguards;
• reporting to senior management on requests, breaches, DPIAs and open risks;
• a central evidence repository linking each requirement to the policies, records and contracts that prove it.

This is where spreadsheets tend to break down. Enactia’s platform supports GDPR and UK GDPR with modules for the record of processing activities, DPIAs, data subject requests, incident and data breach management, vendor and third-party management, and document and evidence management. Risks identified in ROPAs, DPIAs, vendor assessments and requests feed a central risk register, so you can see compliance gaps in one place.

Is there a difference between UK GDPR and EU GDPR?

Yes. The UK GDPR started as a near copy of the EU GDPR, so the principles, lawful bases, rights and core obligations are the same. But the two regimes have different regulators and transfer tools, and the gap has widened since the Data (Use and Access) Act 2025 amended UK law. The statement “there is no difference between the UK GDPR and the EU GDPR” is false.

The Data (Use and Access) Act 2025 also introduced a “reasonable and proportionate” standard for DSAR searches, allows the response clock to pause while you wait for clarification, adds new cookie consent exemptions, raises fines under the Privacy and Electronic Communications Regulations to UK GDPR levels, and creates a duty to handle data protection complaints, including acknowledging them within 30 days. See our guide to the UK Data (Use and Access) Act for the detail, and our comparison of UK GDPR vs EU GDPR for a fuller side-by-side view.

If you serve both markets, build one programme on the common core and record UK and EU variations, such as transfer mechanisms, representatives and regulator contacts, as overlays.

ICO vs EU supervisory authorities: how does the one-stop-shop work?

In the EU, an organisation that carries out cross-border processing and has a main establishment in the EU deals primarily with a lead supervisory authority in the Member State of that main establishment (Article 56). Other concerned authorities cooperate through the consistency mechanism and the European Data Protection Board. This is the one-stop-shop.

A UK or other non-EU organisation with no EU establishment cannot use the one-stop-shop and may deal with the authority in any Member State where affected people are. The ICO is the single UK regulator, so a group operating in both may need to report the same breach to the ICO and an EU authority.

What are the fines for GDPR non-compliance?

Article 83 sets two tiers of administrative fines. The higher tier, for breaches of the principles, lawful basis, consent conditions, data subject rights and international transfer rules, is up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. The lower tier, for breaches of obligations such as records, security, breach notification, DPIAs and DPOs, is up to €10 million or 2%.

Under the UK GDPR the equivalent maximums are £17.5 million or 4%, and £8.7 million or 2%. Regulators can also issue reprimands and order processing to stop, and individuals can claim compensation under Article 82. Under Article 83(2), mitigation, cooperation and a documented programme count in your favour.

GDPR compliance checklist

Use this table as a gap assessment. For each item, ask whether it is in place and whether you can show the evidence.

For the full regulation and how Enactia maps it, see our GDPR framework page. The official text is available on EUR-Lex.

Frequently asked questions

Is there a difference between UK GDPR and EU GDPR?
Yes. The core principles, lawful bases and rights are the same, but the UK has its own regulator (the ICO), its own transfer tools (the IDTA and UK Addendum), a lower age of consent for online services (13), fines set in pounds (up to £17.5 million or 4%), and changes made by the Data (Use and Access) Act 2025, such as recognised legitimate interests and wider permission for automated decision-making.

How long do you have to report a breach?
Under both the EU GDPR and the UK GDPR, a reportable breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. In the UK that authority is the ICO. You only need to report if the breach is likely to result in a risk to individuals, and you must tell affected individuals without undue delay if the risk is high.

Do I need a DPO?
You must appoint one if you are a public authority, or if your core activities involve large-scale regular and systematic monitoring of individuals or large-scale processing of special category or criminal offence data. Some national laws, such as Germany’s, add further cases. If you decide you do not need one, record your reasoning. Many organisations appoint a DPO or privacy lead voluntarily.

How long do you have to respond to a DSAR?
One month from receipt. You can extend by up to two further months if the request is complex or you have received a number of requests from the same person, but you must tell the individual within the first month and explain why.

Does GDPR apply to small businesses?
Yes, regardless of size. The limited ROPA exemption for organisations with fewer than 250 employees rarely applies in full, because it does not cover regular processing or special category data.

Building a GDPR programme you can evidence

GDPR compliance is a programme, not a document. Work through the 12 steps, use the checklist to find gaps and keep evidence for each requirement. If you operate in both the UK and the EU, build once on the shared core and track the differences.

To see how Enactia supports GDPR and UK GDPR programmes, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.