Get audit-ready for UK GDPR
UK GDPR · UK General Data Protection Regulation
UK data protection framework based on the retained EU GDPR, amended by the Data Protection Act 2018 and DPDI Act. Supervised by the ICO.
UK GDPRWhat is UK GDPR?
UK data protection framework based on the retained EU GDPR, amended by the Data Protection Act 2018 and DPDI Act. Supervised by the ICO.
Who it applies to
Organisations processing personal data of people in the UK. Since Brexit the UK and EU regimes are separate instruments, so an organisation serving both may have to satisfy each rather than one.
How the standard is organised
The retained UK version of the GDPR text with domestic modifications, supervised by the Information Commissioner's Office.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
UK GDPR on the Bitkosh platform
The 53 UK GDPR controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- PECR 2003 / DUAA 2025Electronic marketing and cookies (PECR)
Comply with PECR consent and soft opt-in rules for electronic marketing and cookies, including the DUAA exceptions and higher fines (in force from 5 February 2026).
UK-Specific Provisions - DPA s.148Offence: destroying or falsifying information
Do not alter, destroy or conceal information, or obstruct the ICO, in connection with its information, assessment or inspection powers.
ICO Registration & Enforcement - DPA s.170Offence: unlawful obtaining of personal data
Prevent staff knowingly or recklessly obtaining, disclosing or retaining personal data without the controller's consent.
UK-Specific Provisions - Art. 6(1)(f) / Art. 6(1)(ea)Legitimate and recognised legitimate interests
Run and record a legitimate interests assessment, or confirm the purpose falls within a recognised legitimate interest listed in Annex 1 (DUAA 2025 Sch. 4 change, in force from 5 February 2026).
Lawfulness & Transparency - Art. 44-45 / DUAA Sch.7Transfers under UK adequacy regulations
Transfer personal data abroad without extra safeguards only to countries covered by UK adequacy regulations meeting the data protection test.
International Transfers - Art. 40-43Codes of conduct and certification
Consider adhering to approved codes of conduct or certification schemes to help demonstrate compliance.
Accountability & Governance
More privacy & data protection frameworks
Frequently Asked Questions
Who publishes UK GDPR, and who does it apply to?
How is UK GDPR conformance demonstrated?
How is UK GDPR structured?
Ready to get audit-ready for UK GDPR?
See how the Bitkosh Readiness Platform gets you audit-ready for UK GDPR — and the other 47 ready frameworks — from a single control library.