Read with the right scope
Organisations processing personal data under the UK GDPR. Other regimes, including law-enforcement processing, need separate analysis.
Status: Law and official guidance, with suggested implementation steps
Demonstrate the decisions
Accountability under UK GDPR Article 5(2) means taking responsibility for compliance with the data protection principles and being able to demonstrate it. Article 24 requires appropriate technical and organisational measures, taking account of the processing and risks. The ICO explains that the measures depend on context; the existence of a policy alone is not the whole task.
Begin with the processing activity: its purpose, personal data, people affected, recipients, systems and retention. Connect the lawful basis and any additional condition needed for special category data to that activity. Allocate responsibility for transparency, rights requests, processor arrangements, security and review. Do not assume that consent is always the required or appropriate basis.
Screen projects before they begin
A DPIA is required before processing that is likely to create a high risk to individuals. Check the ICO's criteria and list of processing requiring a DPIA, considering the whole context rather than treating any single technology as automatically decisive. Record the screening outcome and reasons even where a full assessment is not required.
A DPIA should explain the processing, assess necessity and proportionality, examine risks to people and identify safeguards. Involve the DPO where appointed and appropriate operational and technical expertise. If high risk remains that cannot be mitigated, consult the ICO before starting the processing.
Use an evidence trail
A suggested project file brings the decision and implementation together. Keep access proportionate and use references to restricted evidence rather than placing sensitive personal data in a general risk register.
- Describe the affected people and a concrete possible harm.
- Name the safeguard, implementation owner and intended completion date.
- Record the residual assessment, decision-maker and reasons for proceeding or pausing.
- Test the safeguard and record the result before treating the action as complete.
- Revisit the assessment when the purpose, scale, data, supplier or technology changes materially.
Choose proportionate guidance
The ICO's data protection audit framework incorporates its Accountability toolkit and is aimed at larger organisations. The ICO directs small organisations to its small-business resources. Use the appropriate resource for your circumstances and check notices explaining that guidance is being updated after the Data (Use and Access) Act 2025.
For a focused companion publication, visit GDPR.me.uk. Its information and this guide support your assessment; neither provides a legal determination, certification or assurance that a particular processing activity is lawful.
Put the guide to work
Start with the evidence.
- A processing description covering purpose, information, recipients, systems and retention.
- The basis and screening decisions, with reasons and references to restricted supporting records.
- Identified harms and safeguards with responsible implementers and residual-risk decisions.
- Results showing the safeguards were tested, together with triggers for revisiting the assessment.
Your first three steps
- Choose a new or materially changed processing activity and map its actual information flows.
- Check the relevant screening questions and document the decision and any uncertainty requiring advice.
- Select one important safeguard and identify how its operation will be tested before the action is closed.
Common gaps to look for
- A generic privacy policy replaces analysis of the specific processing activity.
- The assessment lists safeguards without evidence of implementation.
- Changes to purpose, scale or supplier leave the old assessment untouched.
Review when: Revisit after a material change to purpose, scale, information, technology or supplier, or evidence that a safeguard is ineffective.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the compliance guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- ICO — Guide to accountability and governance ↗Source checked 1 November 2026 · Primary source
- ICO — Data protection impact assessments ↗Source checked 1 November 2026 · Primary source
- ICO — Data protection audit framework and audience ↗Source checked 1 November 2026 · Primary source
- Related independent publication — GDPR.me.uk ↗Source checked 1 November 2026 · Related independent publication · not a primary legal authority
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.