Evaluate your organisation’s GDPR compliance across data handling, consent management, subject rights, breach response, and governance. Get a compliance score with prioritised remediation steps.
| Requirement | GDPR Article | Key Obligation |
|---|---|---|
| Lawful Basis for Processing | Article 6 | Must have a valid legal basis (consent, contract, legal obligation, etc.) for all data processing |
| Consent | Article 7 | Consent must be freely given, specific, informed, unambiguous, and easy to withdraw |
| Right of Access | Article 15 | Individuals can request a copy of their personal data, responded to within 30 days |
| Right to Erasure | Article 17 | Individuals can request deletion of their data when no longer necessary |
| Data Protection by Design | Article 25 | Privacy must be built into systems and processes from the start |
| Record of Processing | Article 30 | Maintain written records of all processing activities |
| Data Breach Notification | Article 33 | Notify the ICO within 72 hours of becoming aware of a qualifying breach |
| Data Protection Impact Assessment | Article 35 | Conduct DPIAs for processing likely to result in high risk to individuals |
| Data Protection Officer | Article 37 | Appoint a DPO where core activities involve large-scale monitoring or special category data |
| International Transfers | Article 46 | Appropriate safeguards required for transfers outside the UK |
Based on the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. This is not legal advice. Contact Cloudswitched for IT compliance support or consult a data protection specialist for legal guidance.
Try our other free security assessments and IT planning tools.
Core requirements include a lawful basis for processing personal data, a clear privacy policy, documented data retention periods, the ability to fulfil subject access requests, and appropriate technical security measures. Most UK SMEs also need to register with the ICO and maintain a record of processing activities.
UK GDPR fines can reach up to £17.5 million or 4% of global annual turnover for the most serious breaches, though ICO enforcement against SMEs typically starts with warnings and improvement notices rather than maximum fines. The bigger practical risk for most businesses is reputational damage after a data breach.
Most UK SMEs are not legally required to appoint a formal Data Protection Officer unless they process personal data at large scale or handle special category data as a core activity. Even without a mandatory DPO, someone should still own data protection responsibility internally.
A subject access request (SAR) is when someone asks what personal data you hold about them. UK GDPR requires a response within one calendar month, extendable by up to two further months for complex requests. This assessment checks whether your processes could meet that deadline.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
20 Aug, 2026
Local SEO is the practice of making a business visible to the people searching for its services nearby the plumber a homeowner in Leeds needs today, the...
19 Aug, 2026
Core Web Vitals are the three field-measured metrics Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift that Google uses to score...
18 Aug, 2026
Virtual CIO services give a growing UK SME the board-level technology judgement of a chief information officer the roadmap, the governance, the vendor...