GDPR IT Compliance Checklist: What UK Businesses Need to Know

GDPR did not stop being a legal requirement just because it is no longer new. Every UK business that holds customer or staff data still has to meet it, and most of that obligation sits with your IT setup — not your legal team. This checklist walks through the technical and organisational controls that actually matter, so you can see where the gaps are before the ICO does.

What does GDPR actually require from your IT setup?

GDPR requires you to know what personal data you hold, why you hold it, and to protect it with "appropriate technical and organisational measures." In practice, that means access controls, encryption, backups, a lawful basis for processing, and a plan for when something goes wrong.

Most breaches investigated by the ICO trace back to basic gaps: shared logins, unencrypted laptops, old accounts nobody deactivated. A working IT compliance checklist closes these before they become a reportable incident.

Data minimisation and retention

Only collect and keep the personal data you genuinely need, for as long as you need it, then delete it. Holding data "just in case" increases your risk without any business benefit.

Set retention periods for each type of data — customer records, HR files, marketing lists — and automate deletion where your systems allow it. A CRM or email platform with no retention policy configured will happily keep every contact indefinitely, which is a liability, not an asset, under GDPR.

Technical security controls that matter most

Multi-factor authentication on every account with access to personal data is the single highest-impact control you can add. It stops the majority of account-takeover breaches that lead to data loss.

Alongside MFA, confirm encryption at rest and in transit for anywhere data is stored, review who has access to what (and remove access for anyone who has left or changed role), and check that backups are tested, not just running. Many of these overlap directly with Cyber Essentials, which is worth pursuing as it demonstrates baseline compliance to customers and regulators alike.

Managing IT suppliers and processor contracts

If a third party processes personal data on your behalf — your IT provider, your payroll software, your email marketing tool — you need a data processing agreement in place with each one. This is a legal requirement, not a formality.

Ask any supplier handling personal data where it is stored (UK or EU data residency matters), how it is secured, and what happens if they suffer a breach. You remain responsible for your data even when someone else is processing it, so supplier due diligence is part of your own compliance, not separate from it.

Breach response and staff training

UK GDPR gives you 72 hours to report a qualifying breach to the ICO once you become aware of it. That clock starts immediately, so a written response plan — who to notify, what to check, who decides if it is reportable — needs to exist before you need it, not during.

Most breaches still start with a person, not a system: a phishing email opened, a password reused, a laptop left on a train. Regular, short staff training on these risks does more for your compliance position than any single piece of software. Combine it with the technical controls above and you have a genuinely defensible position.

If you are not confident your current IT provider has these basics covered, it is worth finding out before an incident forces the question.

Compare IT support providers and get free, no-obligation quotes.