Compliance · UK GDPR
UK GDPR: the technical side, handled
UK data protection law expects security appropriate to the risk. We put the technical and organisational measures in place, support your DPIAs and help you get ready to handle a breach calmly.
What the law asks
Security appropriate to the risk
Article 32 of the UK GDPR requires appropriate technical and organisational measures to protect personal data, taking into account the risks, the state of the art and the cost of putting measures in place.
The law gives examples: encryption and pseudonymisation, keeping systems confidential, available and resilient, being able to restore data in good time after an incident, and regularly testing that the measures work.
There is no single checklist. The ICO publishes guidance on what good looks like, and recognised schemes such as Cyber Essentials are a practical way to show the basics are in place.
- Security of processing (Article 32)
- Data protection impact assessments for high-risk processing (Article 35)
- Reporting certain breaches to the ICO within 72 hours (Article 33)
Technical and organisational measures
The measures we put in place
Sized to your business and the data you hold, and documented so you can show what you do.
Access control
Named accounts, multi-factor authentication and least-privilege access, with starters and leavers handled promptly.
Encryption
Encrypted laptops and phones, secure email options and encrypted backups, so lost devices do not become data breaches.
Backup and restore
Backups of Microsoft 365 and key systems with regular test restores, so you can restore data in good time.
Backup & recoveryPatching and endpoint protection
Devices kept up to date and protected against malware, with alerts reviewed by an engineer.
Cyber securityLogging and monitoring
Sign-in and audit logs switched on and retained, so you can see what happened if something goes wrong.
Staff awareness
Short, practical training on phishing, passwords and handling personal data, refreshed regularly.
Retention and secure disposal
Help applying your retention rules in Microsoft 365, and devices wiped securely before reuse or recycling.
Documentation
A clear record of your systems, where personal data lives and the measures protecting it, ready for your records.
DPIA support
DPIAs with the technical facts filled in
A data protection impact assessment is required before processing that is likely to result in a high risk to individuals, such as new systems that monitor people or handle sensitive data at scale.
The assessment belongs to you and your data protection lead. We supply what they usually struggle to get: how the system works, where data is stored and sent, who can access it, the technical risks and the measures that reduce them.
- Data flow descriptions for new systems and suppliers
- Technical risk assessment and proposed mitigations
- Review of supplier security information
Breach readiness
Ready before anything goes wrong
A reportable breach must be notified to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Preparation makes that achievable.
Step 1: Prepare
An incident plan with names, phone numbers and decisions agreed in advance, and the logging needed to investigate.
Step 2: Detect and contain
We isolate affected accounts or devices, preserve evidence and stop the problem spreading.
Step 3: Assess
We establish what data was involved, whose it was and how it was affected, so you can judge the risk to individuals.
Step 4: Notify
You decide whether to report to the ICO and tell the people affected. We provide the technical facts for the report.
Step 5: Learn
A short review of what happened and what changes, so the same gap is closed for good.
FAQ
UK GDPR questions
This page is general information, not legal advice. Requirements change, so we always work from the current published version of a scheme or regulation, and alongside your legal adviser or data protection lead where the law is involved.
Free IT & security review
Find out where your IT is exposed — in 30 minutes
A senior engineer reviews your setup, security and backups, then gives you a plain-English action list. No obligation, no hard sell.