Evaluate your organisation’s GDPR compliance across data handling, consent management, subject rights, breach response, and governance. Get a compliance score with prioritised remediation steps.
| Requirement | GDPR Article | Key Obligation |
|---|---|---|
| Lawful Basis for Processing | Article 6 | Must have a valid legal basis (consent, contract, legal obligation, etc.) for all data processing |
| Consent | Article 7 | Consent must be freely given, specific, informed, unambiguous, and easy to withdraw |
| Right of Access | Article 15 | Individuals can request a copy of their personal data, responded to within 30 days |
| Right to Erasure | Article 17 | Individuals can request deletion of their data when no longer necessary |
| Data Protection by Design | Article 25 | Privacy must be built into systems and processes from the start |
| Record of Processing | Article 30 | Maintain written records of all processing activities |
| Data Breach Notification | Article 33 | Notify the ICO within 72 hours of becoming aware of a qualifying breach |
| Data Protection Impact Assessment | Article 35 | Conduct DPIAs for processing likely to result in high risk to individuals |
| Data Protection Officer | Article 37 | Appoint a DPO where core activities involve large-scale monitoring or special category data |
| International Transfers | Article 46 | Appropriate safeguards required for transfers outside the UK |
Based on the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. This is not legal advice. Contact Cloudswitched for IT compliance support or consult a data protection specialist for legal guidance.
Try our other free security assessments and IT planning tools.
Core requirements include a lawful basis for processing personal data, a clear privacy policy, documented data retention periods, the ability to fulfil subject access requests, and appropriate technical security measures. Most UK SMEs also need to register with the ICO and maintain a record of processing activities.
UK GDPR fines can reach up to £17.5 million or 4% of global annual turnover for the most serious breaches, though ICO enforcement against SMEs typically starts with warnings and improvement notices rather than maximum fines. The bigger practical risk for most businesses is reputational damage after a data breach.
Most UK SMEs are not legally required to appoint a formal Data Protection Officer unless they process personal data at large scale or handle special category data as a core activity. Even without a mandatory DPO, someone should still own data protection responsibility internally.
A subject access request (SAR) is when someone asks what personal data you hold about them. UK GDPR requires a response within one calendar month, extendable by up to two further months for complex requests. This assessment checks whether your processes could meet that deadline.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
6 Oct, 2026
M365 email archiving is the thing most UK businesses believe they have and very few have configured. The belief usually comes from a reasonable source...
3 Oct, 2026
VoIP security is usually discussed as a technical problem, and the technical controls are well understood encryption for signalling and media, session border...
1 Oct, 2026
A business ISP comparison conducted on headline speed and monthly price will mislead you on both counts. The speed is frequently an up to figure describing a...