Tools
Interactive tools across every regime on the site. Each is driven by data that names the instruments, procedures and governance pages it serves, so it also appears on every one of those pages.
Maps
Statutory overlap map
Pick an activity and see every UK law it engages, the provisions, and where they clash.
Codes of practice map
Statutory codes and key guidance linked to the instruments they sit under, with their legal effect.
Regulators and enforcers map
Who regulates, prosecutes and hears appeals, and which other regulators touch the same activity.
Track changes since 2025
Before and after for every DUAA amendment tracked, with exact statutory wording where held.
Decision tools and lookups
Breach notification decision
Decide who must be told about a personal data breach, and by when.
Which access regime applies?
Route an information request to the right law and regulator: subject access, FOIA, EIR, FOISA or the Scottish EIR.
Lawful basis navigator
Start from what you are trying to do and get the UK GDPR basis to test first, with the extra condition you need for special category data.
International transfer route finder
Find the route for sending personal data out of the UK: adequacy regulations, a UK safeguard, or a derogation.
UK adequacy lookup
Is a destination covered by UK adequacy regulations, and to what extent?
Deadline calculators
SAR, breach, PECR breach, complaints, FOIA, EIR and FOISA, with the right bank holidays.
Horizon tracker
Expiries, reviews, pending commencement, guidance, the sandbox and live cases.
Checklists
Breach: should the Information Commission be told?
A 72-hour screen for a personal data breach: does it meet the risk threshold for notifying the regulator, and what must the notification contain?
Children's data by design
Check an online service likely to be accessed by children against the Age Appropriate Design Code's fifteen standards and the DUAA duty on children's higher protection matters.
Data protection complaints (s.164A)
Check a controller's complaints process against the duty that applies to complaints received from 2026-06-19.
Cookie and storage exemption audit
Screen each cookie, pixel, SDK or similar technology against the PECR consent rule and its Schedule A1 exceptions. Run it once per technology.
DPIA screening
Screen a project for the cases where a data protection impact assessment is mandatory, before the processing starts.
EIR request response (EIR 2004)
Work a request for environmental information to a public authority outside Scotland.
Electronic marketing permission
Before an email, text or call campaign: which PECR route permits it, and are its conditions met?
Automated decision safeguards (Arts 22A to 22D)
Check a solely automated significant decision against the UK safeguards model that replaced Art 22 from 2026-02-05.
FOI request response (FOIA 2000)
Work an FOI request to a public authority in England, Wales or Northern Ireland, or a UK-wide authority, from receipt to appeal.
Restricted transfer check
Work through a transfer of personal data out of the UK: is it restricted, which route applies, and is the data protection test met and recorded?
Legitimate interests assessment
Run the three-part test for UK GDPR Art 6(1)(f), after first checking whether the purpose is a recognised legitimate interest that needs no balancing test.
Processor contract terms (Art 28)
Check a controller to processor contract contains the terms Art 28(3) requires.
Records of processing (Art 30)
Check a record of processing activities holds every field Art 30(1) requires of a controller.
Subject access: intake and stop-the-clock assessment
Work a subject access request from receipt to response, recording each decision that stops the clock, extends it or narrows the search.
Scottish FOI and EIR response (FOISA 2002, EIRS 2004)
Work a request to a Scottish public authority, under FOISA 2002 or, for environmental information, the EIRS 2004.
Special category condition
Find an Art 9(2) condition for special category data, and the DPA 2018 Schedule 1 condition where the UK requires one.