GDPR & Data Protection: A Practical Checklist for 2026

A no-jargon checklist covering DPIAs, processor agreements, breach reporting and the latest ICO guidance.

GDPR isn't going anywhere

Despite years of post-Brexit speculation, UK GDPR is essentially aligned with the EU regime, and the ICO has become noticeably more active in 2025–2026. SMEs are no longer flying under the radar.

This checklist won't make you compliant on its own — but it will tell you, honestly, where you stand.

The non-negotiable basics

  • Up-to-date Record of Processing Activities (ROPA). Even small businesses need one. Spreadsheets are fine.
  • Privacy notice on your website. Plain English, version-dated, covers cookies, contact forms, and any tracking pixels.
  • Lawful basis for every processing activity. "Legitimate interests" is not a default — it requires a balancing test on file.
  • Data Processing Agreements (DPAs) with every processor — that means every SaaS vendor handling personal data, including your CRM, email platform, and cloud storage.

The bits most SMEs miss

  • International transfers. If your CRM hosts data in the US, you need either an adequacy decision or Standard Contractual Clauses on file.
  • Subject Access Request (SAR) process. You have one calendar month. Most companies have no process at all until the first request lands.
  • Breach response plan. 72 hours to notify the ICO. You need decision-makers, comms templates, and forensic contacts identified now, not at 11pm on a Friday.
  • Employee data. Often the largest, most sensitive dataset you hold. Often the least documented.

DPIAs: when you actually need one

A Data Protection Impact Assessment is mandatory for high-risk processing. In practice for SMEs that means:

  • Deploying any AI tool that processes personal or client data
  • New CCTV or biometric systems
  • Large-scale profiling or automated decisions
  • New HR monitoring software

Don't wait for the ICO to ask. Document the assessment when you make the decision.

What the ICO is focused on in 2026

  • AI and large language model use of personal data
  • Adtech and consent management platforms
  • Subject access response times
  • Children's data and the Age Appropriate Design Code

A 60-minute self-audit

Block an hour. Open your website privacy notice, your supplier list, your last security incident, and your HR system. If you can't answer "where is this data, who can access it, and on what legal basis" for each — you have work to do.

Need help?

We help London businesses build right-sized GDPR programmes that pass scrutiny without paralysing the business. Book a free strategy call or message us on WhatsApp to start.