UK GDPR Compliance
An independent assessment of how your organisation handles personal data against the UK GDPR and the Data Protection Act 2018.
- Standard
- UK GDPR / DPA 2018
- Indicative timeline
- 6-12 weeks, depending on scope and readiness
- Discipline
- Compliance & Security
- Assessment type
- Independent third-party assessment
The standard
Overview
The UK GDPR is the retained EU General Data Protection Regulation, amended for the UK after EU exit and read with the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It governs how personal data is collected, used, shared, stored and erased. Article 5 sets seven principles, from lawfulness and purpose limitation to accountability. The Information Commissioner's Office enforces it, with fines reaching £17.5 million or four per cent of worldwide turnover.
Compliance is a legal duty, and accountability means you must be able to demonstrate it. An independent assessment gives you documented evidence for the ICO, for customers running due diligence, and for your board. It also names the obligations you are not meeting.
UKCert assesses your processing against the legislation: records of processing, lawful bases, retention, security measures, processor contracts, international transfers, rights requests and breach handling. You receive a report with findings and required actions. This is an independent assessment, not an ICO-approved certification under Article 42.
Who this is for
- Organisations established in the UK that handle personal data
- Businesses offering goods or services to people in the UK
- Processors acting on the instructions of another controller
- Employers holding staff and recruitment records
- Organisations handling special category or children's data
What it gives you
Why organisations certify
What a certified UK GDPR / DPA 2018 assessment gives you once the certificate is issued.
Regulatory Exposure Reduced
Gaps in lawful basis, retention and security are identified and corrected before a complaint, subject access request or ICO enquiry brings them to light.
Demonstrable Accountability
Article 5(2) requires you to show compliance, not merely claim it. Records of processing, assessments and decisions are put in a form you can produce on request.
Due Diligence Answers
Customers and partners ask detailed data protection questions before contracting. A completed assessment gives consistent, evidenced answers instead of replies drafted from scratch.
Rights Requests Handled
Access, erasure and objection requests follow a defined route with recorded timescales, so statutory deadlines are met and responses stay consistent.
Breach Response Ready
Reportable breaches must reach the ICO within seventy-two hours. Detection, assessment and notification steps are agreed in advance, with owners named.
Transfers Documented
Data leaving the UK is mapped to adequacy regulations, the international data transfer agreement or the UK addendum, with transfer risk assessments recorded.
Scope
What the assessment covers
The areas an assessor works through. Your final scope is confirmed in writing before any audit is booked.
- Personal data inventory and record of processing activities
- Lawful basis and special category condition mapping
- Privacy notices and transparency information
- Data subject rights procedures and response logs
- Data protection impact assessments
- Retention schedule and secure disposal
- Controller and processor contracts under Article 28
- International transfer mechanisms and transfer risk assessments
How it runs
The assessment, stage by stage
From first enquiry to certificate. Each stage is agreed with you before it starts.
-
Data Mapping
We trace personal data through your systems and suppliers: what is collected, why, where it sits, who can reach it, how long it is kept and where it goes.
-
Lawful Basis Review
Each processing activity is tested against Article 6, and special category data against Article 9 and Schedule 1 of the Data Protection Act 2018, with the basis recorded.
-
Documentation Review
Privacy notices, retention schedules, processor contracts, transfer agreements, policies and impact assessments are examined against what the legislation requires them to contain.
-
Controls and Interviews
We assess security measures and question the people who handle requests, incidents and marketing consent, comparing written procedure with what actually happens day to day.
-
Findings Report
You receive a report setting out each finding, the article or section it relates to, the risk it carries and the action needed, ordered so the highest exposure comes first.
-
Reassessment
Remediation is verified once the actions are complete. The assessment is then repeated annually, or sooner when processing, systems or suppliers change materially.
Questions
UK GDPR / DPA 2018 — frequently asked
Anything here that does not cover your situation, put it to an assessor rather than guessing at it.
Same discipline
Other schemes in Compliance & Security
Certifying against more than one standard?
Where you hold several standards, shared clauses are assessed once in a combined visit rather than as separate audits. Talk it through with an assessor before you decide what UK GDPR / DPA 2018 should sit alongside.