Compliance FrameworksEurope
UK GDPR / DPA 2018
UK General Data Protection Regulation + Data Protection Act 2018 - post-Brexit data protection.
UK General Data Protection Regulation + Data Protection Act 2018 - post-Brexit data protection.
| Short name | UK GDPR |
| Region | Europe |
| Country or scope | United Kingdom |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers UK GDPR
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for UK GDPR.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for UK GDPR and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
UK-GDPR-32 Security of Processing | Controllers and processors must implement technical and organisational measures appropriate to the risk, including the ability to ensure ongoing integrity of processing systems, which implies integrity verification of the software performing the processing (UK GDPR Art. 32) | Scan |
UK-GDPR-30 Records of Processing Activities | Controllers and processors must maintain records of their processing activities, including descriptions of technical security measures, which presupposes an enumerated account of the systems and software components used for processing (UK GDPR Art. 30) | Scan |
UK-GDPR-28 Processor Guarantees | Controllers may engage only processors providing sufficient guarantees to implement appropriate technical and organisational measures, which requires knowing which suppliers stand behind the components of the processing stack (UK GDPR Art. 28) | Scan |
UK-GDPR-33 72-Hour Breach Notification Readiness | Personal data breaches must be notified to the ICO without undue delay and where feasible within 72 hours, including the categories and approximate scope affected; scoping that quickly requires individually identifiable system components (UK GDPR Art. 33) | Scan |
UK-GDPR-25 Data Protection by Design and Default | Controllers must build data protection into processing systems at design time and throughout their lifecycle, which requires knowing the exact versions of components in use so protective measures can track the deployed software (UK GDPR Art. 25) | Scan |
UK-GDPR-5-2 Accountability Principle | The controller is responsible for, and must be able to demonstrate, compliance with the data protection principles, which is supported by formally identified, timestamped machine-readable documentation of the processing systems (UK GDPR Art. 5(2)) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
UK-GDPR-Art5 | Principles of Personal Data Processing |
UK-GDPR-Art6 | Lawful Basis for Processing |
UK-GDPR-Art13 | Privacy Information: Direct Collection |
UK-GDPR-Art14 | Privacy Information: Indirect Collection |
UK-GDPR-Art25 | Data Protection by Design and by Default |
UK-GDPR-Art28 | Processor Contracts and Obligations |
UK-GDPR-Art30 | Records of Processing Activities (ROPA) |
UK-GDPR-Art32 | Security of Processing |
UK-GDPR-Art33 | Personal Data Breach Notification to ICO |
UK-GDPR-Art34 | Communication of Breach to Data Subjects |
UK-GDPR-Art35 | Data Protection Impact Assessment (DPIA) |
DPA2018-Part2 | DPA 2018 Part 2: General Processing |
DPA2018-Part3 | DPA 2018 Part 3: Law Enforcement Processing |
DPA2018-Sch1 | DPA 2018 Schedule 1: Special Category Conditions |
Policy templates
Written for UK GDPR:
- UK GDPR Privacy Notice
- Records of Processing Activities (ROPA)
- Data Protection Impact Assessment (DPIA) Procedure
And 22 from the standard set, adapted to UK GDPR.