Procedures
What you do, step by step. Each UK procedure is one complete page with its deadline calculator, and any step whose failure is a criminal offence names that offence. 14 procedures across 4 regimes.
Data protection (10)
Subject access requests
How a subject access request works under the UK GDPR and the DPA 2018, as amended by the DUAA 2025.
Rectification
How to handle a request to correct inaccurate personal data or complete incomplete data under UK GDPR Art 16, including restricting use while accuracy is checked and telling the people you shared it with.
Erasure
How to handle a request for erasure under UK GDPR Art 17: when a ground applies, when an exception lets you keep the data, and what to do about recipients, published data and backups.
Restriction of processing
How to handle a request to restrict processing under UK GDPR Art 18: the four grounds, what restriction allows you to keep doing, and the duty to tell the person before lifting it.
Data portability
How to handle a data portability request under UK GDPR Art 20: when the right applies, what format to use, direct transmission to another controller, and protecting other people's data.
Objection and direct marketing
How to handle an objection under UK GDPR Art 21, which is absolute for direct marketing, together with the PECR rules on stopping electronic marketing and the suppression list that makes both stick.
Automated decision-making rights
How to run, and respond to challenges about, significant decisions based solely on automated processing under UK GDPR Arts 22A to 22D, in force from 2026-02-05.
Personal data breach notification
How to detect, assess, record and, where required, notify a personal data breach under the UK GDPR.
Data protection complaints
How a controller handles a data protection complaint under the duty in DPA 2018 s.164A, for complaints received from 2026-06-19: make complaining easy, acknowledge within 30 days, investigate, keep the person informed and give the outcome without undue delay.
Making a restricted international transfer
How to send personal data out of the UK lawfully: decide whether the transfer is restricted, find the route (adequacy regulations, an Art 46 safeguard with the data protection test, or an Art 49 derogation), and record it.
Electronic communications (1)
Freedom of information (2)
FOI request response (FOIA 2000)
How a public authority in England, Wales or Northern Ireland, or a UK-wide authority, handles a request under FOIA 2000: validity, routing, the 20 working day limit, cost and vexatious refusals, exemptions with the public interest test, refusal notices, internal review and appeal.
Scottish FOI and EIR response (FOISA 2002, EIRS 2004)
How a Scottish public authority handles an information request under FOISA 2002 or, for environmental information, the EIRS 2004: 20 working days with no public interest extension, Scottish bank holidays, substantial prejudice tests, review and the Scottish Information Commissioner.