UK GDPR Policies for UK Businesses
12 ICO-aligned policies drafted for your business — privacy notice, ROPA, DSAR procedure, breach response and more. Ready in 48 hours.
Data Protection & Privacy Essentials pack
12 policies · £350 one-off
Lifetime access · no renewal · bespoke to your business
What is UK GDPR?
UK GDPR is the UK's retained version of EU GDPR, in force since 1 January 2021 and enforced by the Information Commissioner's Office (ICO). It sits alongside the Data Protection Act 2018 and applies to almost every UK business that handles personal data — customer records, employee data, marketing lists, support tickets, CCTV footage, cookies on your site.
The cornerstone is Article 5(2) accountability: you don't just have to comply, you have to be able to prove you comply. That means documented policies, a ROPA, DPIAs for risky processing, a breach response plan, and DPAs with every processor. The ICO's first question in any investigation is always "show me your documentation".
Who needs UK GDPR policies?
- Every UK business handling personal data — including employee HR records, so this effectively means every employer.
- UK B2B SaaS companies — customers ask for your privacy policy and DPA before signing.
- E-commerce and DTC brands — cookie compliance and marketing-consent scrutiny is rising.
- Agencies and consultancies processing client data as a processor — you need contracts and documented safeguards.
- Charities and not-for-profits — the ICO has specifically targeted fundraising and supporter-data practices.
Policies you need for UK GDPR
The ICO's accountability guidance translates into the following 12 documents, all included in our Data Protection & Privacy Essentials pack:
Privacy Policy
External-facing Article 13/14 notice — lawful basis, retention, rights.
Data Retention Policy
Defensible retention periods by data category, with secure deletion.
DSAR Procedure
One-month response window, ID verification, exemptions handling.
Data Breach Notification
72-hour ICO reporting, data-subject notification triggers, log.
ROPA
Article 30 record of processing activities — controller and processor.
DPIA Template
Article 35 screening + full DPIA for high-risk processing.
International Data Transfer
UK IDTA, UK Addendum to EU SCCs, transfer risk assessments.
Lawful Basis Register
Article 6 basis per activity, plus Article 9 conditions for special data.
Marketing Consent Policy
PECR-aligned consent capture, soft opt-in, unsubscribe handling.
Subject-Access Response Template
Pre-drafted letters for valid, clarified, and refused requests.
Third-Party DPA
Article 28 processor contract — sub-processors, audits, transfers.
Cookie Policy
PECR + UK GDPR cookie banner rules, category-level consent.
Realistic timeline to ICO-ready compliance
Most UK SMEs can reach demonstrable compliance in 2–4 weeks once the policies are drafted. PolicySuite compresses the drafting phase from the traditional 4–8 weeks to 48 hours.
- Day 1: Register with the ICO if you haven't already (£40/£60/£2,900 depending on size).
- Days 2–3: Buy the Data Protection & Privacy Essentials pack, answer the structured questions, get 12 bespoke policies in 48 hours.
- Week 2: Populate ROPA, run DPIA on highest-risk processing, sign DPAs with key processors.
- Week 3: Publish privacy and cookie notices, update cookie banner, distribute internal policies.
- Week 4: Run a DSAR and breach drill, collect staff acknowledgements, file evidence.
- Ongoing: Annual review, update ROPA when processing changes, refresh training.
Policy packs for UK GDPR
Data Protection & Privacy Essentials
12 policies · £350 · UK GDPR + EU GDPR aligned
Incident Notification & Breach Reporting
8 policies · £250 · 72-hour ICO reporting readiness
Third-Party Risk & Contracting
10 policies · £300 · Article 28 DPA suite
Startup Essentials
10 policies · £250 · lightweight starter set
Further reading
Frequently asked questions
What policies does UK GDPR actually require?
UK GDPR does not enumerate a fixed list of policies, but Article 5(2) accountability means you must demonstrate compliance with documented measures. The ICO expects a privacy policy, retention schedule, DSAR procedure, breach response plan, ROPA (Article 30), DPIA template, lawful-basis register, international-transfer policy, and supporting DPAs with processors. Most UK SMEs run 10–14 distinct policies to cover it.
Is UK GDPR different from EU GDPR?
UK GDPR is the UK's domestic version post-Brexit, sitting alongside the Data Protection Act 2018. Substantive obligations are almost identical but references to supervisory authority point to the ICO, fines are in sterling (max £17.5m or 4% of global turnover), and international transfers use UK IDTA or the UK Addendum rather than EU SCCs. If you serve EU residents you still need to comply with EU GDPR separately.
Do I need a Data Protection Officer?
A DPO is mandatory only if you are a public authority, conduct large-scale systematic monitoring, or process special-category data at scale. Most UK SMEs do not need a formal DPO but must still appoint someone accountable and register with the ICO (£40–£2,900 fee depending on size). PolicySuite policies use a named "Privacy Lead" role that covers either scenario.
How much does the ICO fine for GDPR breaches?
Maximum fines are the higher of £17.5 million or 4% of annual global turnover for the most serious infringements. In practice ICO enforcement focuses on reprimands, enforcement notices, and fines from a few thousand pounds upwards for SMEs. For an SME the bigger exposure is usually the cost of a data-subject claim or losing a customer contract after a breach.
What is a ROPA and do I need one?
A Record of Processing Activities under Article 30 documents every processing activity: purpose, categories of data subject and data, recipients, retention, security measures, and transfers. It is mandatory unless you are under 250 employees AND your processing is occasional AND non-special-category AND low-risk — which excludes almost every B2B SaaS. Our pack includes a ROPA template plus the policy explaining how to maintain it.
What does the Data Protection & Privacy Essentials pack include?
12 UK GDPR / EU GDPR-aligned policies: privacy policy, data retention, DSAR procedure, breach notification, ROPA, DPIA template, international transfers, lawful basis register, marketing consent, subject-access response template, third-party DPA, and cookies. Lifetime access, bespoke to your organisation — see the product page for live pricing.
Get ICO-ready in 48 hours
Get 12 bespoke UK GDPR policies drafted for your business — lifetime access, no renewal.
Get Started — £350