Below are common areas organisations focus on when reviewing their GDPR approach.
1. Assigning responsibility
Some organisations are legally required to appoint a Data Protection Officer (DPO). Others assign data protection responsibilities internally to someone with appropriate knowledge.
A DPO’s core responsibilities include monitoring the organisation’s compliance with data protection law, advising on data protection impact assessments (DPIAs), acting as a point of contact for the Information Commissioner’s Office (ICO), and serving as a contact for individuals whose data is being processed. The DPO must operate independently and report to the highest management level.
2. Understanding the data you handle
This often involves reviewing:
- The types of data held
- Where it is stored
- Who has access
- How long it is retained
- How it is secured
For example, an organisation may start by mapping the flow of personal data across internal systems and third-party platforms. This might involve working with department leads to identify what data is collected, how it moves through the organisation, and any points where it is stored, shared or deleted. This type of overview can help highlight areas where data protection risks or improvement opportunities may exist.
3. Keeping privacy information clear
Privacy notices should explain how personal data is collected, used and shared, helping individuals understand how their information is managed.
4. Responding to rights requests
Organisations need appropriate procedures to recognise rights requests and manage them effectively.
A rights request is a formal request made by an individual to exercise one or more of their data protection rights under the UK GDPR. These include the right to access their personal data, request corrections, object to processing, or request erasure, among others. These requests must be responded to without undue delay and, in most cases, within one calendar month.
5. Handling data breaches
A personal data breach may result from cyber incidents, human error, compromised accounts or misdirected information.
Where a breach presents a risk to individuals, the ICO must be notified within 72 hours.
Read about when to report a data breach to the ICO.
6. Maintaining records of processing activities
Maintaining records of processing activities helps organisations demonstrate accountability under the UK GDPR. These records typically include information such as the purposes of processing, the types of data involved, who the data is shared with, how long it is retained, and the security measures in place.
For example, a business might maintain a central register or spreadsheet that logs each type of personal data it processes, the lawful basis for doing so, and any third parties that data is shared with. This helps ensure transparency and supports effective data protection governance.
7. Raising awareness
Training helps staff understand their roles in protecting personal data and supports consistent day-to-day practices.
