UK GDPR compliance consulting for personal data you can explain and evidence to the ICO.

What it is

What are the UK GDPR and the Data Protection Act 2018?

When the United Kingdom left the European Union, it kept the EU General Data Protection Regulation as part of its own law. That retained version is the UK GDPR, and it works together with an amended Data Protection Act 2018. The Information Commissioner's Office, the UK regulator, describes the core of the two regimes plainly: the principles, the rights of individuals and the obligations on organisations are the same as in the EU text.

In practice you must know what personal data you hold, why, who receives it and how it is protected, and be able to show it. No certificate proves that; decisions, records and working controls do.

Current position. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its data protection chapter amends both the UK GDPR and the DPA 2018, a second chapter deals with privacy and electronic communications, and a later part provides for an Information Commission to take over from the office of the Information Commissioner. Some provisions took effect on Royal Assent, some two months later and the rest on dates set by regulations, and the ICO has said its guidance is under review. On the EU side, the European Commission renewed its two adequacy decisions for the UK on 19 December 2025. GDPR vs UK GDPR: what differs and what does not

Who it is for

Who needs UK GDPR compliance?

Any organisation that decides how personal data is used under UK law, or processes it on another organisation's instructions, carries duties under the UK GDPR. Organisations usually come to Sterling for one of four reasons:

• A UK customer sends a data protection questionnaire. Enterprise clients want your processing records, processor terms and breach procedure before they share their customers' data.
• A tender asks how you handle personal data. Public and private bids score the answers, and a written, working programme scores better than a policy statement.
• The regulator or an individual is asking. A complaint, a request for access to someone's data or a security incident shows quickly whether the procedures exist and whether people follow them.
• You are part of a group across the UK and the EU. Two regimes, two regulators and data flowing both ways call for one programme with a UK layer, not two teams working from different documents.

Requirements

What are the main UK GDPR requirements?

Because the ICO confirms that the UK principles, rights and obligations match the EU Regulation, the programme is built around the same requirement areas. The list below summarises them by area rather than by article; the exact UK wording, as amended by the 2025 Act, is confirmed for your organisation during the gap analysis.

• Principles and accountability: use personal data lawfully, fairly and openly, for set purposes, no more than needed, accurate, kept only as long as necessary and secure, and be able to show you do.
• Lawful basis, consent and special category data: choose and record a lawful basis for each activity, manage consent where you rely on it, and meet the extra conditions for sensitive data such as health or biometrics.
• Transparency and individual rights: tell people how their data is used and respond properly to requests for access, correction, erasure, restriction, portability and objection.
• Controller and processor duties: build privacy into systems from the start, contract with processors on the required terms and keep records of processing activities.
• Security and personal data breaches: apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, and assess, report and record breaches.
• Data protection impact assessments: assess high-risk processing before it starts and act on what the assessment finds.
• Data protection officer: decide whether one is required, record the decision and give the role the independence it needs.
• International transfers: send personal data outside the UK only through a transfer route UK law recognises.
• Data Protection Act 2018 and the 2025 amendments: apply the UK statute that sits alongside the UK GDPR and track the changes as each part of the 2025 Act commences.

Becoming compliant

How do you achieve UK GDPR compliance?

There is no certification audit at the end. Compliance is shown through your records and your behaviour when someone checks: a client audit, a questionnaire, an ICO enquiry or an individual's request. Sterling prepares and builds the programme with you; the judgement belongs to them.

1. 01
   Set the scope of the programme.Agree the legal entities, sites and countries, your role as controller or processor for each activity, and whether EU law also reaches you.
2. 02
   Gap analysis: compare current practice with UK law.Inventory the processing, systems, suppliers and data flows, test notices, contracts and controls against each requirement area, and agree actions with owners and dates.
3. 03
   Implement and record as you go.Settle lawful bases and retention, issue notices and processor terms, put access and security controls into use, complete impact assessments and train the people who handle personal data.
4. 04
   Audit, review and close the findings.An internal audit against the UK GDPR and DPA 2018 and a management review with your privacy lead; findings are raised by us first and closed with evidence.
5. 05
   Answer the regulator or customer review.Respond to client audits, due-diligence questionnaires or an ICO enquiry from evidence that already exists, then keep the programme current under Sustain™.

Check the offer before you sign. Nobody can issue a "UK GDPR certificate"; a provider selling one is selling paper. If a client wants a certificate, the right route is ISO/IEC 27701 privacy management certification from an accredited certification body, and UK accreditation can be checked with UKAS through its CertCheck search. Ask who maps the data, who takes the lawful-basis decisions and where the evidence will be kept.

Cost

How much does UK GDPR compliance cost?

A small single-site firm and a contact centre holding millions of customer records need very different programmes. We commit to a proposal that shows every component and a fee that does not move.

Timeline

How long does UK GDPR compliance take?

Our estimate is three to eight months for a first programme, shorter where an ISO/IEC 27001 system and a data inventory already exist, longer where many systems, processors and countries have to be mapped and contracted. Writing documents is rarely what sets the pace; decisions on lawful bases, retention and transfers are, along with the time controls need to run and leave records.

Your engagement

What your UK GDPR engagement includes

Sterling does not certify, and for the UK GDPR no certificate exists: compliance is judged by the ICO and by your customers, and our work is consulting, not legal advice. Engagements follow Sterling OS™. You choose Design™, where our consultants guide and your team builds, or Drive™, where we manage and do the work with your people; they are alternative levels of support, not stages. Automate™ is Effivity, and Sustain™ keeps the programme current once it is in place.

• Scope, gap analysis and programme plan

  Owners, dates and decision-makers agreed before implementation begins.

• Records, notices, contracts and procedures

  Built from your actual processing on Sterling's own template sets, with your system and process owners.

• Effivity ISO & GRC software

  Registers, workflows and evidence in one place from day one, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audit and management review

  Conducted or facilitated as agreed, with findings closed before a client or the ICO looks.

• Review readiness and support

  Evidence packs for client audits and questionnaires, and support when a request, complaint or incident arrives.

Compliance is judged by regulators and your customers' auditors. Sterling's work is consulting, not legal advice.

Often combined with

Standards organisations pair with UK GDPR and Data Protection Act 2018

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.