A software company implements UK GDPR by mapping personal data, keeping records of processing, running impact assessments for risky features, writing and training on policies, building data protection into the product, and rehearsing breach handling. The ICO's accountability guidance is the best checklist. This post explains the order.
The UK GDPR and the Data Protection Act 2018 sit side by side. This post is general information, not legal advice, and legal counsel should confirm your position.
What does the regulator expect you to be able to show?
The ICO frames the core idea as accountability: you must be able to show how you comply, not just claim it. Its guidance lists these measures: appoint a data protection officer where required, keep records of processing, carry out data protection impact assessments, put proportionate policies in place and show they are followed, and apply data protection by design and default.
For a software company that usually means evidence in your engineering and operations systems, not a binder.
Step 1: Do you know what personal data you hold?
Start with a data map. List each product, internal system and vendor that touches personal data. For each, write what data, whose data, why you collect it, where it flows, and how long you keep it. Include logs, analytics events, support tickets and backups. Developers often forget those.
Step 2: Are your records of processing in place?
The ICO says most organisations must keep a record of processing activities under Article 30, covering purposes, data sharing and retention. Records of consent and of breaches are needed as well. Turn the data map into that record, and give each entry an owner. Check whether any exemption applies to you before you assume it does.
Step 3: Do you need a DPO?
Some organisations must appoint a data protection officer. The ICO says the DPO advises on the UK GDPR, monitors compliance and trains staff, must report to the highest management level, operate independently and have adequate resources. Decide, in writing, whether the requirement applies to you and why. If you appoint one voluntarily, the same expectations apply.
Step 4: When is an impact assessment needed?
A DPIA is required before processing likely to result in high risk to individuals' interests. It documents the risks and your decisions. For a software company, new features that profile users, process data at scale or use a new technology, such as an AI model on customer data, are the usual triggers. Put a DPIA question in your design review template so it gets asked at the start, not before launch.
Step 5: Have you written proportionate policies?
The ICO says to put policies in place where proportionate, and to show they are followed through training, monitoring and audits. A small company needs a short set: data protection, retention, access requests, breach response and supplier due diligence. Then check that engineers actually know them.
Step 6: Is data protection built into the product?
Data protection by design and default means building protection in from the start. The ICO's examples include minimising data, using pseudonymisation and improving security. In practice: collect only the fields you use, set short default retention, restrict internal access, encrypt data, and design deletion so a request does not mean a manual hunt through databases.
Step 7: Can you handle a breach?
The ICO says certain personal data breaches must be reported to the ICO and, in some cases, to affected individuals, and that all breaches must be recorded whether or not they are reported. Check the ICO's breach guidance for the current deadline and thresholds. Then write a runbook: who decides, who is told, what is logged, and how you gather facts fast. Rehearse it once.
What to do
- Build the data map and name an owner for each system.
- Turn it into a record of processing.
- Document whether you need a DPO.
- Add a DPIA trigger to design reviews.
- Write short policies and train staff.
- Add minimisation, retention and deletion to your engineering standards.
- Write and rehearse a breach runbook, and keep a breach log.
Safeguard's compliance automation can help collect evidence for controls and track tasks. It does not make you compliant on its own, and compliance remains your responsibility.
Quick check
Do you have to record breaches you do not report?
Yes. The ICO says all breaches must be recorded, whether or not they are reported.
When is a DPIA required?
Before processing likely to result in high risk to individuals' interests, according to the ICO.
Sources
Last reviewed: 18 October 2026.
