United Kingdom · Compliance
UK GDPR and the Data Protection Act 2018 compliance in the United Kingdom
Achieve UK GDPR and the Data Protection Act 2018 compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- London office team
- Effivity software included
- Academy training included
Who asks for UK GDPR and the Data Protection Act 2018 in the UK
Clients include
UK GDPR and the Data Protection Act 2018 compliance in the UK at a glance
Data Protection Act 2018 and the UK GDPR is the instrument itself: it applies to the organisations within its scope, and buyers and partners in the UK ask for evidence that you meet it.
Royal Assent for the Data (Use and Access) Act 2025 on 19 June 2025 began the most significant revision of UK data protection law since the Data Protection Act 2018. The Act amends the UK GDPR, the 2018 Act and PECR, and its changes are being commenced in stages, so policies written for the earlier text need checking against what is now in force. The fundamentals overseen by the Information Commissioner's Office remain: lawful processing, transparency, rights handling, accountability and security appropriate to the risk. The ICO describes Cyber Essentials as a good starting point for that security, while warning that many organisations must go further. There is no UK GDPR certificate to buy; compliance is evidenced through records of processing, notices, impact assessments, contracts, breach procedures and controls. Sterling's London office builds and refreshes that evidence for UK controllers and processors, aligning it with the EU GDPR where clients also serve the EEA.
Who needs UK GDPR and the Data Protection Act 2018 in the UK, and what happens without it
These are the organisations in the UK that most often need to show UK GDPR and the Data Protection Act 2018.
- Every UK controller and processorThe UK GDPR and DPA 2018 set the general regime overseen by the ICO.
- Organisations updating policies for the Data (Use and Access) Act 2025The Act amends the UK GDPR, DPA 2018 and PECR in stages.
- Suppliers on government contracts handling citizens' personal informationPPN 014 adds Cyber Essentials or equivalent controls.
- Health and care providers and their IT suppliersDSPT self-assessment applies alongside data protection law.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkUK GDPR and the Data Protection Act 2018 requirements in the UK
Strip away the vocabulary and UK GDPR, with the Data Protection Act 2018, asks an organisation to comply in six areas of data handling.
In the UK these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: UK GDPR and the Data Protection Act 2018 explained →
How to achieve UK GDPR and the Data Protection Act 2018 compliance in the UK
One team from the London office carries the work from scoping to sign-off. England, Scotland, Wales and Northern Ireland, on-site from London; remote delivery for distributed teams.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against UK GDPR and the Data Protection Act 2018 and the UK requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does UK GDPR and the Data Protection Act 2018 compliance take in the UK?
There is no standard duration: it depends on your scope and on how much of the system already runs. In the UK these are the factors that set the timeline.
- Number of processing activities and systems to map
- Changes needed for the Data (Use and Access) Act 2025
- Processor and international transfer review
- Volume of rights requests and breach handling maturity
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does UK GDPR and the Data Protection Act 2018 compliance cost in the UK?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In the UK these factors move both.
- Number of entities and processing activities
- Contract and notice remediation
- Security control remediation
- Training needs across teams
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
UK GDPR and the Data Protection Act 2018 consultants and assessors in the UK
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers UK GDPR and the Data Protection Act 2018 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in the UK are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive UK GDPR and the Data Protection Act 2018 in the UK (3)
| Instrument | How it treats the standard |
|---|---|
| Data Protection Act 2018 and the UK GDPR | The instrument itself Obligations for controllers and processors; regulated by the ICO. |
| Data (Use and Access) Act 2025 | Amending law Royal Assent 19 June 2025; amends UK GDPR, DPA 2018 and PECR; commenced in stages. |
| UK GDPR security principle (ICO guidance) | Regulator guidance Security principle; Cyber Essentials a good starting point; ICO-approved certification schemes may help demonstrate compliance. |
Accreditation, audit language and remote audits in the UK
Compliance, not certification: the UK GDPR has no general certificate. Evidence is the organisation's records of processing, privacy notices, lawful bases, data protection impact assessments, rights handling, breach procedures, contracts and security measures. ICO-approved certification schemes and ISO/IEC 27701 certification by an accredited body are optional. The Data (Use and Access) Act 2025 amends the UK GDPR and DPA 2018, with changes commenced in stages; confirm which provisions are in force from the commencement regulations on GOV.UK before quoting them. Edition and transition details: UK GDPR and the Data Protection Act 2018 hub →
Audit language
English; Welsh public bodies may set Welsh-language requirements for notices.
Remote and on-site
Data mapping and gap workshops can be on-site or remote; the law prescribes no external assessment.
UK GDPR and the Data Protection Act 2018 in the UK: questions clients ask
What does the Data (Use and Access) Act 2025 change?
It amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. The Act received Royal Assent on 19 June 2025, and its provisions are commenced in stages. Which changes apply to you at a given point depends on the commencement regulations, so check them on GOV.UK and with your counsel.
Is Cyber Essentials enough for UK GDPR security?
Probably not on its own. The ICO calls Cyber Essentials a good starting point for the security principle, but says organisations may have to go beyond it, depending on their processing. The UK GDPR requires measures appropriate to the risk, so assess your own processing and confirm the adequacy of your controls with your counsel.
Is there a UK GDPR certificate?
No, there is no general UK GDPR certificate. ICO-approved certification schemes may be used as one element in demonstrating compliance with the security principle, and ISO/IEC 27701 is an optional framework. Neither is compulsory, and neither proves compliance by itself. Take advice from your counsel on how you evidence compliance.
More on UK GDPR and the Data Protection Act 2018 for UK organisations
Other standards UK businesses ask Sterling for
Organisations in the UK often combine UK GDPR and the Data Protection Act 2018 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the London office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act 2018 and the UK GDPR — legislation.gov.uk (accessed 5 Oct 2026)
- Data (Use and Access) Act 2025 — gov.uk (accessed 5 Oct 2026)
- UK GDPR security principle (ICO guidance) — ico.org.uk (accessed 5 Oct 2026)
- PPN 014: Cyber Essentials scheme — gov.uk (accessed 5 Oct 2026)
- PPN 006: Taking account of Carbon Reduction Plans in the procurement of major government contracts — gov.uk (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the London team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uk@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice