UK GDPR, made simple
Know what personal data you hold and why. AI drafts your records, privacy notices and policies from everything it knows about your organisation. You review, approve and stay on top of it.
UK GDPR sets out how organisations must handle personal data: collect only what they need, keep it safe and be open about what they do with it. Getting it right shows customers and staff they can trust you with their information.
- data protection principles
- 7
- rights for individuals
- 8
- hours to report a breach that puts people at risk
- 72
How it works
From data map to day-to-day compliance
Add your organisation
Tell us who you are, and upload your privacy notice and any policies you already have so we can build on them.
Map your data
List the personal data you hold, where it comes from, who you share it with and how long you keep it.
Check the gaps
AI drafts an answer against each principle from what you’ve captured. You review, amend and confirm.
Build your records
AI turns everything you’ve captured into your record of processing, privacy notices and data protection policies.
Stay compliant
Log subject access requests and breaches, track staff training and keep your records current as things change.
Everything,
in one place
Your existing documents
Upload what you have. We compare it against each requirement and flag conflicts and gaps.
Record of processing
What personal data you hold, why, your lawful basis, who it’s shared with and how long you keep it.
Privacy notices
Drafted from your record of processing in plain English, for customers, staff and website visitors.
Impact assessments
AI-drafted data protection impact assessments (DPIAs) for high-risk processing, ready for you to review.
Policy pack
Data protection, retention, breach and subject access policies, written by AI for your organisation, with versioning and approval.
Requests and breaches
A log of subject access requests and breaches, with the one-month and 72-hour deadlines tracked for you.
Common questions
- What is UK GDPR?
- UK GDPR is the UK’s version of the EU’s General Data Protection Regulation. Together with the Data Protection Act 2018, it sets the rules for collecting, using and storing personal data about people in the UK. The Data (Use and Access) Act 2025 has since updated parts of it, and the Information Commissioner’s Office (ICO) regulates it.
- Does it apply to us?
- If you hold personal data about people in the UK, almost certainly. That includes customer records, staff files and mailing lists, and it applies whether your organisation is based in the UK or not.
- Is there a UK GDPR certificate?
- Not in the way there is for Cyber Essentials. The ICO approves some voluntary certification schemes, but most organisations show compliance through their records, policies and how they handle data day to day. That’s what we help you get in order.
- Already have Cyber Essentials?
- Good start. It goes a long way on the security side of UK GDPR, and your organisation details and asset register carry across in the same ComplySmart account.
Get your data in order
and keep it that way.
UK GDPR is coming to ComplySmart. Book a call with our sales manager to hear what’s planned and get early access.
Book a call with our sales manager(opens in a new tab)