Checklists
16 interactive checklists across every regime on the site. Each item names its statutory basis; ticks stay in your browser and never leave it. Screening checklists tell you whether a duty is triggered, condition checklists whether every condition is met, and working records keep the evidence of what you did.
Data protection
Automated decision safeguards (Arts 22A to 22D)
Check a solely automated significant decision against the UK safeguards model that replaced Art 22 from 2026-02-05.
Breach: should the Information Commission be told?
A 72-hour screen for a personal data breach: does it meet the risk threshold for notifying the regulator, and what must the notification contain?
Children's data by design
Check an online service likely to be accessed by children against the Age Appropriate Design Code's fifteen standards and the DUAA duty on children's higher protection matters.
Data protection complaints (s.164A)
Check a controller's complaints process against the duty that applies to complaints received from 2026-06-19.
DPIA screening
Screen a project for the cases where a data protection impact assessment is mandatory, before the processing starts.
Legitimate interests assessment
Run the three-part test for UK GDPR Art 6(1)(f), after first checking whether the purpose is a recognised legitimate interest that needs no balancing test.
Processor contract terms (Art 28)
Check a controller to processor contract contains the terms Art 28(3) requires.
Records of processing (Art 30)
Check a record of processing activities holds every field Art 30(1) requires of a controller.
Restricted transfer check
Work through a transfer of personal data out of the UK: is it restricted, which route applies, and is the data protection test met and recorded?
Special category condition
Find an Art 9(2) condition for special category data, and the DPA 2018 Schedule 1 condition where the UK requires one.
Subject access: intake and stop-the-clock assessment
Work a subject access request from receipt to response, recording each decision that stops the clock, extends it or narrows the search.
Electronic communications
Cookie and storage exemption audit
Screen each cookie, pixel, SDK or similar technology against the PECR consent rule and its Schedule A1 exceptions. Run it once per technology.
Electronic marketing permission
Before an email, text or call campaign: which PECR route permits it, and are its conditions met?
Freedom of information
FOI request response (FOIA 2000)
Work an FOI request to a public authority in England, Wales or Northern Ireland, or a UK-wide authority, from receipt to appeal.
Scottish FOI and EIR response (FOISA 2002, EIRS 2004)
Work a request to a Scottish public authority, under FOISA 2002 or, for environmental information, the EIRS 2004.