UK GDPR requires you to process personal data with appropriate technical and organisational security, and that duty covers the processors you use. It does not name SBOMs. But a current inventory of the software components that touch personal data is a practical way to show you assessed risk and manage suppliers.
What does UK GDPR actually say about security?
The ICO's guide to data security explains that a key principle of the UK GDPR is processing personal data securely by means of "appropriate technical and organisational measures", known as the security principle. It tells you to read that alongside Article 32, which says that taking into account the state of the art, costs, and the nature, scope, context and purposes of processing, plus the risk to people's rights and freedoms, the controller and the processor shall implement appropriate measures.
The ICO says measures must be appropriate to your circumstances and the risk your processing poses, and may consider state of the art and cost. They must ensure confidentiality, integrity and availability, allow timely restoration of access after an incident, and include a process for regularly testing effectiveness. The ICO adds that, given new threats and vulnerabilities, it may be sensible to assume your systems are vulnerable and act accordingly.
Note that the ICO page states this guidance is under review because of changes made by the Data (Use and Access) Act. Check the current page before you cite it in a policy.
Where does the software supply chain come in?
Personal data is handled by code you wrote and by code you did not: open source libraries, base images, SaaS components and managed services. A vulnerable library in a service that processes personal data is a weakness in "the security of your processing", wherever the library came from.
The ICO checklist includes: we ensure that any data processor we use also implements appropriate technical and organisational measures. For a software company, your own cloud and software suppliers often are processors. The ICO says the additional security requirements apply to data processors too, so both sides carry the duty.
Does UK GDPR require an SBOM?
No. I searched the ICO's data security guide and it contains no reference to SBOMs or a software bill of materials, and I am not aware of a UK GDPR provision that mandates one. Do not tell a customer it is "required by UK GDPR."
What the regulation asks for is a risk-based, tested set of measures. An SBOM is a good way to support that. You cannot assess risk in components you cannot list, and you cannot answer "were we affected?" after a new vulnerability without knowing what you ship. A dated inventory, linked to the services that process personal data, is evidence that you looked.
NIST's Secure Software Development Framework, SP 800-218, is a useful neutral reference for the practices behind that evidence. It recommends a core set of high-level secure software development practices that can be integrated into any development life cycle.
How do you build the practice?
Keep it proportionate, as the regulation expects. Generate an inventory for every service that processes personal data. Record the supplier or processor for each hosted dependency. Keep a record of when you scanned, what you found and what you did about it. Run a test cycle that you can describe, because the ICO lists regular testing and review as part of the security duty.
Also connect it to your incident plan. If a vulnerable component leads to a personal data breach, the inventory shortens the time to establish scope.
What to do
- Map which services process personal data, then generate an SBOM or equivalent inventory for each.
- List processors and sub-suppliers, and confirm each has appropriate measures in the contract.
- Scan inventories for known vulnerabilities on a schedule, and record the outcome and fixes.
- Define the test and review cycle for your measures and keep the results.
- Link components to your incident response plan so you can scope an exposure quickly.
- Check the ICO page for updates after the Data (Use and Access) Act changes. Safeguard's free scan at gold.safeguard.sh/scan covers up to 100 dependencies and can start an inventory. This is not legal advice.
Quick check
Does the ICO require an SBOM?
The ICO data security guide does not mention SBOMs. An SBOM is a practical way to evidence risk assessment, not a stated requirement.
Do processors have security duties under UK GDPR?
Yes. The ICO says the security requirements also apply to data processors, and Article 32 names both controller and processor.
Sources
Last reviewed: 18 October 2026.
