UK GDPR Policies for UK Businesses
Prepare editable policy drafts from your business answers after checkout. Review their scope and approve drafts before use.
Data Protection & Privacy Essentials pack
12 policies · £350 one-off
Lifetime access · no renewal · bespoke to your business
After checkout, answer questions about your business. Confirm your answers before generating policy drafts, then review and edit those drafts before use. The listed jurisdictions define this product’s coverage.
Free account · preview sample policies · buy pack when readyWhat is UK GDPR?
Quick answer. UK GDPR is the UK's retained version of EU GDPR, in force since 1 January 2021 and enforced by the Information Commissioner's Office (ICO). It sits alongside the Data Protection Act 2018 and applies to almost every UK business that handles personal data — customer, employee, marketing, support, CCTV or website cookie data. Article 5(2) accountability requires controllers to evidence compliance, not just claim it.
UK GDPR is the UK's retained version of EU GDPR, in force since 1 January 2021 and enforced by the Information Commissioner's Office (ICO). It sits alongside the Data Protection Act 2018 and applies to almost every UK business that handles personal data — customer records, employee data, marketing lists, support tickets, CCTV footage, cookies on your site.
The cornerstone is Article 5(2) accountability: you don't just have to comply, you have to be able to prove you comply. That means documented policies, a ROPA, DPIAs for risky processing, a breach response plan, and DPAs with every processor. The ICO's first question in any investigation is always "show me your documentation".
Who needs UK GDPR policies?
Quick answer. Every UK business handling personal data — including employee HR records, which makes this effectively every employer. UK B2B SaaS firms (customers ask for privacy notices and DPAs before signing), e-commerce and DTC brands (cookie + marketing-consent scrutiny), agencies and consultancies acting as processors, and charities (the ICO has specifically targeted fundraising and supporter-data practices).
- Every UK business handling personal data — including employee HR records, so this effectively means every employer.
- UK B2B SaaS companies — customers ask for your privacy policy and DPA before signing.
- E-commerce and DTC brands — cookie compliance and marketing-consent scrutiny is rising.
- Agencies and consultancies processing client data as a processor — you need contracts and documented safeguards.
- Charities and not-for-profits — the ICO has specifically targeted fundraising and supporter-data practices.
Policies you need for UK GDPR
Quick answer. The ICO's accountability guidance translates into 12 documents: privacy policy (Article 13/14 notice), data retention, DSAR procedure, data breach notification (72-hour ICO reporting), ROPA (Article 30), DPIA template (Article 35), international data transfer (UK IDTA + Addendum), lawful basis register, marketing consent (PECR-aligned), subject-access response templates, third-party DPA (Article 28) and cookie policy.
The ICO's accountability guidance translates into the following 12 documents, all included in our Data Protection & Privacy Essentials pack:
Privacy Policy
External-facing Article 13/14 notice — lawful basis, retention, rights.
Data Retention Policy
Defensible retention periods by data category, with secure deletion.
DSAR Procedure
One-month response window, ID verification, exemptions handling.
Data Breach Notification
72-hour ICO reporting, data-subject notification triggers, log.
ROPA
Article 30 record of processing activities — controller and processor.
DPIA Template
Article 35 screening + full DPIA for high-risk processing.
International Data Transfer
UK IDTA, UK Addendum to EU SCCs, transfer risk assessments.
Lawful Basis Register
Article 6 basis per activity, plus Article 9 conditions for special data.
Marketing Consent Policy
PECR-aligned consent capture, soft opt-in, unsubscribe handling.
Subject-Access Response Template
Pre-drafted letters for valid, clarified, and refused requests.
Third-Party DPA
Article 28 processor contract — sub-processors, audits, transfers.
Cookie Policy
PECR + UK GDPR cookie banner rules, category-level consent.
Realistic timeline to ICO-ready compliance
Planning your rollout. There is no fixed readiness timetable. After purchase, complete the business questions and confirm your answers to generate editable drafts. Your team must review, approve and implement the policies. Evidence collection and any independent assessment take additional time.
Policy packs for UK GDPR
Data Protection & Privacy Essentials
12 policies · £350 · UK GDPR + EU GDPR aligned
Incident Notification & Breach Reporting
21 policies · £500 · 72-hour ICO reporting readiness
Third-Party Risk & Contracting
18 policies · £500 · Article 28 DPA suite
Startup Essentials
10 policies · £200 · lightweight starter set
PolicySuite vs GRC platforms vs consultant vs DIY
Compare the scope. PolicySuite prepares editable policy drafts from your business answers. Compare the included documents and current shop price with the scope offered by a consultant, a template supplier or a governance platform. Implementation, specialist advice and independent assessment may require separate work.
Further reading
Frequently asked questions
What policies does UK GDPR actually require?
UK GDPR does not enumerate a fixed list of policies, but Article 5(2) accountability means you must demonstrate compliance with documented measures. The ICO expects a privacy policy, retention schedule, DSAR procedure, breach response plan, ROPA (Article 30), DPIA template, lawful-basis register, international-transfer policy, and supporting DPAs with processors. Most UK SMEs run 10–14 distinct policies to cover it.
Is UK GDPR different from EU GDPR?
UK GDPR is the UK's domestic version post-Brexit, sitting alongside the Data Protection Act 2018. Substantive obligations are almost identical but references to supervisory authority point to the ICO, fines are in sterling (max £17.5m or 4% of global turnover), and international transfers use UK IDTA or the UK Addendum rather than EU SCCs. If you serve EU residents you still need to comply with EU GDPR separately.
Do I need a Data Protection Officer?
A DPO is mandatory only if you are a public authority, conduct large-scale systematic monitoring, or process special-category data at scale. Most UK SMEs do not need a formal DPO but must still appoint someone accountable and register with the ICO (£40–£2,900 fee depending on size). PolicySuite policies use a named "Privacy Lead" role that covers either scenario.
How much does the ICO fine for GDPR breaches?
Maximum fines are the higher of £17.5 million or 4% of annual global turnover for the most serious infringements. In practice ICO enforcement focuses on reprimands, enforcement notices, and fines from a few thousand pounds upwards for SMEs. For an SME the bigger exposure is usually the cost of a data-subject claim or losing a customer contract after a breach.
What is a ROPA and do I need one?
A Record of Processing Activities under Article 30 documents every processing activity: purpose, categories of data subject and data, recipients, retention, security measures, and transfers. It is mandatory unless you are under 250 employees AND your processing is occasional AND non-special-category AND low-risk — which excludes almost every B2B SaaS. Our pack includes a ROPA template plus the policy explaining how to maintain it.
What does the Data Protection & Privacy Essentials pack include?
12 UK GDPR / EU GDPR-aligned policies: privacy policy, data retention, DSAR procedure, breach notification, ROPA, DPIA template, international transfers, lawful basis register, marketing consent, subject-access response template, third-party DPA, and cookies. Lifetime access, bespoke to your organisation — see the product page for live pricing.
Start your policy drafts
Get 12 bespoke UK GDPR policies drafted for your business — lifetime access, no renewal.
Get Started — £350References and primary sources
Quick answer. The framework guidance on this page is reviewed against the primary-source documents below. Each link resolves to an official regulator or standards-body publication so an auditor, procurement reviewer or DPO can verify the alignment without taking the page on trust.
- GDPR (Regulation EU 2016/679, EUR-Lex) — the primary EU regulation text.
- European Data Protection Board — the EU DPA committee whose guidelines bind controllers and processors.
- ICO accountability framework — the UK regulator’s practical compliance hub.
- Data Protection Act 2018 — the UK statute giving force to UK GDPR.
- ICO enforcement actions — precedent on monetary penalties and undertakings.
- ISO/IEC 27701 (privacy) — the privacy-information management standard most controllers map alongside GDPR.
In our experience working with UK SMEs and similar organisations across the EU and US, the framework pages that survive enterprise vendor reviews are the ones that cite primary sources rather than secondary blog posts. Many UK SMEs typically discover this only after their first failed vendor questionnaire — the reviewer asked for a clause-to-source map and the standard reply pointed at a marketing page rather than the relevant regulator. The references above are the standing set we cite from inside the policies themselves so the chain stays intact end-to-end.