Thanks for taking part

Governance and Accountability

Do you have a named person with data protection responsibilities or Data Protection Officer if requiredYesNo

Risk: No accountable lead means breaches may go undetected, reporting obligations missed, and no one ensures compliance with Articles 37–39 UK GDPR.

Likely cost: Failure to appoint or properly support a DPO can attract administrative fines of up to £8.7 million or 2% of global annual turnover for accountability failures, plus investigation and consultancy costs.

ICO Enforcement: ICO enforcement – Clearview AI was fined £7.5 million for unlawfully processing UK residents’ biometric data without a lawful basis or proper oversight, breaching fundamental governance and accountability principles.

Do you have the following – approved and version controlled with annual review, including:

Data Protection PolicyYesNo

Risk: Out-of-date or missing policies cause inconsistent handling of data, incidents, and rights requests.

Likely costs: Weak governance has led to multi-million-pound fines for inadequate organisational measures. Max penalty: £17.5m or 4% of turnover.

ICO/legal enforcement: ICO enforcement – British Airways was fined £20 million for failing to implement adequate security and governance measures.

Data Sharing PolicyYesNo

Information Security PoliciesYesNo

Data Incident ProcedureYesNo

Data Subject Request ProcedureYesNo

Data Retention PolicyYesNo

Acceptable Use PolicyYesNo

Bring Your Own Device PolicyYesNoN/A

Remote Working PolicyYesNoN/A

Risk: Out-of-date or missing policies cause inconsistent handling of data, incidents, and rights requests.

Likely costs: Weak governance has led to multi-million-pound fines for inadequate organisational measures. Max penalty: £17.5m or 4% of turnover.

ICO/legal enforcement: ICO enforcement – British Airways was fined £20 million for failing to implement adequate security and governance measures.

DPIA screening process, high-risk DPIAs completed and signed-offYesNo

Risk: Out-of-date or missing policies cause inconsistent handling of data, incidents, and rights requests.

Likely costs: Weak governance has led to multi-million-pound fines for inadequate organisational measures. Max penalty: £17.5m or 4% of turnover.

ICO/legal enforcement: ICO enforcement – British Airways was fined £20 million for failing to implement adequate security and governance measures.

Staff training at induction and refreshed annuallyYesNo

Risk: Untrained staff increase mis‑sends, phishing success and late breach detection (Art. 32).

Likely costs: Breach response, forensics and notifications; serious cases can reach £17.5m or 4% where training/control gaps drive impact.

ICO/legal enforcement: ICO enforcement – Interserve was fined £4.4m after a phishing attack where training and process failings aggravated the breach.

Privacy metrics viewed by senior managementYesNo

Risk: No leadership oversight allows risks to accumulate; weak accountability evidence when incidents occur (Art. 5(2)).

Likely costs: Often results in reprimands/corrective orders; when tied to harm, sanctions escalate. Exposure up to £8.7m or 2% for governance failings.

ICO/legal enforcement: ICO enforcement – Systemic oversight failures are cited in major fines (e.g., BA) as aggravating factors in accountability/security assessments.

ROPA and Lawful Basis

ROPA complete & current (purposes, data categories, recipients, retention, transfers, lawful basis)YesNo

Risk: Inability to evidence what you process, why, and where it goes; accountability failure (Arts. 5(2), 30).

Likely costs: Remediation, consultancy, and where linked breaches occur, fines up to £8.7m or 2% (accountability tier), rising to £17.5m/4% if combined with serious infringements.

ICO/legal enforcement: ICO enforcement – Major cases (e.g., BA £20m) cite systemic accountability failures; poor records aggravate findings.

Lawful basis recorded per activity (Art. 6) lawful basis documentedYesNo

Risk: Unlawful processing and lack of fairness/transparency (Arts. 5(1)(a), 6, 13/14).

Likely costs: Fines up to £17.5m or 4% of turnover; re‑permissioning and complaints handling costs.

ICO/legal enforcement: ICO enforcement – TikTok was fined £12.7m for processing children’s personal data without a lawful basis and failing transparency duties.

Special category data has a valid (Art. 9) lawful basis documentedYesNoN/A

Risk: Processing special category data without an Art. 9 condition is unlawful.

Likely costs: Fines up to £17.5m or 4%; high reputational and litigation risk.

ICO/legal enforcement: ICO enforcement – Easylife was fined £250k for unlawfully inferring/using health data for marketing without a valid condition.

Criminal Offence Data (Art. 10) Lawful basis documentedYesNoN/A

Risk: Processing special category data without an Art. 9 condition is unlawful.

Likely costs: Fines up to £17.5m or 4%; high reputational and litigation risk.

ICO/legal enforcement: ICO enforcement – Easylife was fined £250k for unlawfully inferring/using health data for marketing without a valid condition.

Legitimate Interests Assessments (LIAs) are activity specific, approved, and accessibleYesNo

Risk: LI without a robust necessity/balancing test risks unlawful processing and unfairness.

Likely costs: Enforcement and mandated changes; exposure up to £17.5m or 4% depending on scale/harm.

ICO/legal enforcement: ICO enforcement – Experian received an Enforcement Notice requiring significant transparency and LI changes for data broking used in marketing.

Retention schedule linked to each ROPA line and deletion/archiving routines operating and testedYesNo

Risk: Keeping data longer than necessary breaches storage limitation and increases breach impact.

Likely costs: Typically reprimands and mandated remediation; when linked to breaches, exposure escalates to higher‑tier fines.

ICO/legal enforcement: ICO enforcement – Public bodies have received reprimands for retention failures (e.g., CCTV/document handling issues requiring remedial action).

International transfers captured in ROPA; TRA completed; mechanism recorded (IDTA/SCCs/UK Addendum/UK US Data Bridge)YesNoN/A

Risk: Failure to document or assess international data transfers risks breaching Chapter V of the UK GDPR. Without a Transfer Risk Assessment (TRA) or appropriate safeguards (e.g. IDTA, SCCs, Addendum, or adequacy decision), personal data may be exposed to inadequate protections overseas. This undermines accountability and data subject rights, especially where third-country surveillance laws apply.

Likely costs: Legal review, contract remediation, and data-flow redesign costs (£5k–£50k typical). Serious or repeated non-compliance can attract fines up to £17.5 million or 4 % of global turnover. Reputational and operational impact if transfers must be suspended or data deleted.

ICO/legal enforcement: ICO enforcement – Clearview AI Ltd was fined £7.5 million and ordered to delete UK residents’ data for unlawful international transfers to the US. The ICO has also issued reprimands to UK public authorities for lacking TRA documentation and failing to identify appropriate transfer mechanisms.

Data minimisation & purpose limitation checks applied (fields reviewed; no excessive data)YesNo

Risk: Collecting or retaining more personal data than necessary breaches Arts. 5(1)(b) and 5(1)(c) UK GDPR (purpose limitation & data minimisation). Excessive collection increases storage, security, and breach risks, undermines fairness, and exposes the organisation to accountability failures.

Likely costs: Remediation and data-cleansing projects (£5k–£50k typical). If excessive or irrelevant data causes harm or is compromised, the ICO may impose fines up to £17.5 million or 4 % of global turnover. There are also indirect costs from re-engineering systems and reputational damage from “over-collection” findings.

ICO/legal enforcement: ICO enforcement – The Ministry of Justice received a reprimand after retaining excessive prisoner data and failing to implement minimisation controls. The Home Office and police forces have also been reprimanded for collecting and storing personal data beyond necessity, breaching the purpose limitation and data minimisation principles

High risk populations flagged (children, vulnerable individuals, employees) with extra safeguardsYesNo

Risk: Failing to identify and apply enhanced protections for high-risk populations breaches the fairness and accountability principles (Arts. 5(1)(a) and 5(2) UK GDPR). Children, vulnerable individuals, and employees are more susceptible to harm from automated decisions, tracking, or data misuse. Inadequate safeguards may also breach Recital 75 and Art. 35, which require extra consideration in DPIAs.

Likely costs: Remediation, re-engineering, and consultation with affected groups (£10k–£100k typical). If sensitive or child data is mishandled, fines can reach £17.5 million or 4 % of global turnover, alongside reputational damage and potential compensation claims.

ICO/legal enforcement: ICO enforcement – TikTok was fined £12.7 million for unlawfully processing children’s personal data without adequate age verification or transparency, failing to apply appropriate safeguards for minors. The ICO has also reprimanded organisations that processed employee and vulnerable-person data without additional privacy measures.

Data Subject Rights

Clear process (webform/email) with ID verification stepsYesNo

Risk: Requests get lost or identity not verified, risking wrongful disclosure and timeline breaches (Arts. 12–15).

Likely costs: Investigation, breach notifications, remediation; serious failures can reach £17.5m or 4%.

ICO/legal enforcement: ICO enforcement – Jason Blake (care‑home director) was convicted and fined for concealing records to block a SAR (s.173 DPA 2018). / Legal claim – Gregg Wallace has filed a claim for £10,000 alleging the BBC failed to comply with his SAR; BBC disputes liability.

Playbook with procedure and responses for access/rectification/erasure/restriction/portability/objectionYesNo

Risk: Inconsistent or unlawful handling (late/partial responses; unjustified refusals) breaching Arts. 12–15.

Likely costs: Complaint management and remediation; systemic failures can approach £17.5m/4%.

ICO/legal enforcement: ICO enforcement – Plymouth City Council and Norfolk County Council were reprimanded for repeated failures to meet SAR deadlines. Jason Blake conviction underscores criminal liability for intentional obstruction.

One month timer & reminders; extensions documented with reasonsYesNo

Risk: Missing the one‑month deadline or failing to justify extensions breaches Arts. 12/15.

Likely costs: Reprimands and mandated fixes are common; systemic delays escalate exposure toward higher tiers.

ICO/legal enforcement: ICO enforcement – Glasgow City Council and City of Edinburgh Council were reprimanded for SAR backlogs. / Legal claim – Gregg Wallace v BBC highlights litigation/PR risk from delays.

Complaint/escalation route explained (incl. ICO)YesNo

Risk: Omitting escalation info breaches transparency and fairness (Arts. 12–14) and fuels complaints.

Likely costs: Increased ICO scrutiny and remedial orders; when combined with other failures, exposure up to £17.5m or 4%.

ICO/legal enforcement: ICO enforcement – Organisations that failed to explain escalation and mishandled SARs received formal reprimands and warnings. One complaint can trigger an ICO investigation. Saga were fined £250,000 based on complaints to the ICO.

Security and Incident Response

Formal Information Security Policy in place and reviewed annuallyYesNo

Risk: Absent/weak policy produces inconsistent controls; breach of Arts. 5(1)(f) and 32.

Likely costs: Fines up to £17.5m or 4%; remediation and PR costs often exceed £500k.

ICO/legal enforcement: ICO enforcement – British Airways was fined £20m for inadequate measures to secure customer data.

Regular penetration testing and vulnerability managementYesNo

Risk: Untested/unguarded systems remain exposed to known exploits; failure to act on vulns breaches Art. 32.

Likely costs: High remediation and audit costs; exposure up to £17.5m or 4%.

ICO/legal enforcement: ICO enforcement – Marriott International was fined £18.4m for insufficient due diligence and security testing following acquisition.

Incident playbook & breach log; ICO/data subject notification decision treeYesNo

Risk: Chaotic breach handling and delayed notifications breach Arts. 33–34.

Likely costs: Investigation, containment, legal fees; exposure up to £17.5m or 4% where notice is late or response inadequate.

ICO/legal enforcement: ICO enforcement – Interserve was fined £4.4m after a phishing attack; poor incident response aggravated impact.

Staff trained to escalate incidents promptlyYesNo

Risk: Delays and mishandling increase harm and fines.

Likely costs: Training remediation and PR response; exposure at least to £8.7m/2% for governance gaps; higher if combined with security failings.

ICO/legal enforcement: ICO enforcement – Interserve’s £4.4m fine cited inadequate awareness and failure to act on alerts.

Transparency (Privacy Notices)

Up to date layered notices for customers, staff, suppliers, website usersYesNo

Risk: Lack of transparency; individuals cannot understand or exercise rights.

Likely costs: Fines up to £17.5m or 4%; re‑permissioning and rewrite costs.

ICO/legal enforcement: ICO enforcement – TikTok fine (£12.7m) also covered failures in providing adequate information to users.

If profiling/AI/ADM used: purpose, logic (in brief), likely effects, rights incl. human interventionYesNoN/A

Risk: Failing to explain the purpose, logic, and effects of automated decision-making or profiling breaches Articles 13(2)(f), 14(2)(g), and 15(1)(h) UK GDPR, as well as Article 22(3) (right to human intervention). Individuals cannot understand or challenge automated outcomes, creating fairness, transparency, and accountability risks — especially in credit, employment, or behavioural analytics contexts.

Likely costs: Investigations, transparency projects, and system redesign (£20k–£150k typical). Serious or large-scale infringements can attract fines up to £17.5 million or 4 % of global turnover. Reputational costs are often greater where profiling affects vulnerable or high-risk individuals.

ICO/legal enforcement: ICO enforcement – Experian was issued an Enforcement Notice for failing to clearly explain profiling and automated decision-making in its credit marketing activities. The ICO has also warned that failing to provide information on the “logic involved” and the right to human review in AI systems may result in enforcement action under Article 22.

Controller & DPO/lead contact, transfer details, retention summaries includedYesNo

Risk: Omitting key information such as the controller’s identity, DPO or lead contact, transfer mechanisms, or retention periods breaches Articles 13 and 14 UK GDPR. Individuals cannot exercise their rights or understand how long their data will be kept or where it is processed, undermining transparency and accountability obligations.

Likely costs: Complaints, investigations, and reissuing privacy information (£5k–£50k typical). Repeated or systemic failures can attract fines up to £17.5 million or 4 % of global turnover, as well as mandatory corrective action from the ICO and loss of public trust.

ICO/legal enforcement: ICO enforcement – The Department for Education was threatened with a £10 million fine for failing to ensure transparency and accountability in data sharing, including inadequate privacy information. The ICO has also reprimanded several public authorities for omitting DPO contact details and retention explanations from privacy notices

Cookie info links to preferences/consent toolYesNo

Risk: Setting analytics/tracking before consent breaches PECR Reg. 6.

Likely costs: PECR enforcement; CMP fixes (£5k–£20k) and reputational risk.

ICO/legal enforcement: ICO enforcement – Notices issued to major sites (incl. We Buy Any Car, The Telegraph) for setting cookies prior to consent.

Marketing, Cookies and PECR

Lawful basis recorded (consent or soft opt in where allowed)YesNo

Risk: Unlawful marketing breaches PECR Reg. 22 and Art. 6 UK GDPR.

Likely costs: PECR fines up to £500k; if paired with GDPR issues, exposure up to £17.5m or 4%.

ICO/legal enforcement: ICO enforcement – Halfords was fined £30k for sending 498,179 unsolicited emails without valid consent/soft opt‑in.

Unsubscribe works; suppression lists maintainedYesNo

Risk: Missing/broken unsubscribe breaches PECR Reg. 23; ignoring opt‑outs = unlawful processing.

Likely costs: PECR penalties up to £500k; repeat issues can escalate under GDPR.

ICO/legal enforcement: ICO enforcement – We Buy Any Car was fined £200k for unlawful emails/SMS without valid consent or functioning opt‑outs.

Cookie consent before non essential cookies; preferences remembered & audit loggedYesNo

Risk: Setting analytics/tracking before consent breaches PECR Reg. 6.

Likely costs: PECR enforcement; CMP fixes (£5k–£20k) and reputational risk.

ICO/legal enforcement: ICO enforcement – Notices issued to major sites (incl. We Buy Any Car, The Telegraph) for setting cookies prior to consent.

Proof of consent/eligibility for lists; ad platform data sharing documentedYesNo

Risk: Missing/broken unsubscribe breaches PECR Reg. 23; ignoring opt‑outs = unlawful processing.

Likely costs: PECR penalties up to £500k; repeat issues can escalate under GDPR.

ICO/legal enforcement: ICO enforcement – We Buy Any Car was fined £200k for unlawful emails/SMS without valid consent or functioning opt‑outs.

Suppliers

Supplier register maintained; roles (controller/processor) identifiedYesNo

Risk: Unrecorded sharing prevents demonstrating accountability (Art. 5(2)).

Likely costs: Reprimands/corrective orders; systemic gaps escalate to £8.7m or 2%.

ICO/legal enforcement: ICO enforcement – DfE £10m threatned fine also cited failures in records of sharing.

Data Processing Agreements (DPAs) signed with processors; sub processor controls documentedYesNo

Risk: Sharing without written agreement or lawful basis risks unlawful disclosure and loss of control (Arts. 5(1)(a), 24, 26–28).

Likely costs: Up to £17.5m or 4% for unlawful disclosure; remediation and complaint handling often >£250k.

ICO/legal enforcement: ICO enforcement – Department for Education was fined £10m for sharing data of 28m learners with a commercial organisation without lawful basis/controls.

Due diligence completed (security posture, certifications, breach history) before onboardingYesNo

Risk: Onboarding insecure/non‑compliant vendors creates secondary breach risk and shared liability.

Likely costs: Investigations and remediation (£100k–£500k); fines up to £8.7m or 2%.

ICO/legal enforcement: ICO enforcement – Interserve’s £4.4m fine referenced failures in managing system and supplier vulnerabilities.

Ongoing monitoring cadence for high risk suppliers (at least annually)YesNo

Risk: Failing to review or monitor high-risk suppliers breaches Articles 5(2) (accountability) and 28(1)–(3) UK GDPR. Without annual checks, supplier vulnerabilities, data handling issues, or contractual breaches can go unnoticed — increasing exposure to security incidents, loss of control over data, and regulatory scrutiny for poor oversight.

Likely costs: Supplier re-audit programmes and incident remediation (£10k–£250k typical). If a processor breach occurs and oversight was inadequate, both parties may face enforcement. Fines can reach £8.7 million or 2 % of global turnover, alongside business disruption and reputational harm.

ICO/legal enforcement: ICO enforcement – Marriott International was fined £18.4 million for failing to conduct due diligence and ongoing monitoring of systems acquired through Starwood Hotels, resulting in long-term unauthorised access to millions of records. The ICO has also reprimanded public bodies for failing to monitor third-party processors holding sensitive personal data

International transfers assessed (TRA completed); mechanism recorded (IDTA/SCCs/UK Addendum/UK US Data Bridge)YesNo

Risk: Transferring personal data internationally without an appropriate safeguard breaches Chapter V of the UK GDPR. Failure to complete a Transfer Risk Assessment (TRA) or implement a valid transfer mechanism (e.g., International Data Transfer Agreement, Standard Contractual Clauses, or adequacy decision such as the UK–US Data Bridge) exposes individuals’ data to jurisdictions with weaker protections. It also prevents demonstrating compliance with the accountability principle (Art. 5(2)).

Likely costs: Legal and operational remediation (typically £10k–£100k), suspension of transfers, and potential deletion of unlawfully transferred data. Serious or repeated non-compliance can attract fines up to £17.5 million or 4 % of global annual turnover, plus contractual and reputational damage if clients or partners rely on your transfer assurances.

ICO/legal enforcement: ICO enforcement – Clearview AI was fined £7.5 million and ordered to delete all UK personal data for unlawfully transferring and processing biometric information outside the UK without appropriate safeguards. The ICO has also issued reprimands to public authorities for failing to carry out Transfer Risk Assessments or to record lawful transfer mechanisms.

Incident assistance & notification timelines defined and testedYesNo

Risk: Without defined and tested breach-assistance timelines, organisations risk missing the 72-hour notification requirement under Article 33 UK GDPR and breaching contractual duties under Article 28(3)(f). Unclear expectations between controllers and processors can delay containment, increase harm, and demonstrate weak governance and accountability.

Likely costs: Delayed or mishandled notifications often lead to reprimands, enforcement notices, or fines up to £17.5 million or 4 % of global turnover where notification failures are systemic. Typical incident response costs (forensics, legal, PR) range from £25k–£250k depending on breach severity and affected data.

ICO/legal enforcement: ICO enforcement – Ticketmaster was fined £1.25 million for failing to identify and report a payment-card data breach promptly, breaching Articles 32 and 33. The ICO has also reprimanded several UK councils and NHS bodies for delayed or incomplete breach notifications resulting from unclear escalation processes.

AI and Automated Decision-Making (if applicable)

Inventory of AI/ADM use cases; screen for "solely automated + significant effect"YesNoN/A

Risk: People may be subject to automated decisions without safeguards, breaching Art. 22.

Likely costs: Investigations, redesign; fines up to £17.5m or 4%.

ICO/legal enforcement: ICO enforcement – Experian received an Enforcement Notice for profiling/ADM transparency failures.

Safeguards: meaningful human review, override/appeal route, explainabilityYesNoN/A

Risk: Bias/inaccuracy goes unchecked; fairness and accountability breached (Arts. 5, 22).

Likely costs: Bias testing, oversight programmes, compensation; up to £17.5m or 4%.

ICO/legal enforcement: ICO enforcement – Serco Leisure ordered to cease biometric attendance where necessity/proportionality and human choice were lacking.

Training data sources noted; fairness/bias checks recorded; performance monitoredYesNoN/A

Risk: Unfair/incorrect outputs breach fairness (Art. 5(1)(a)) and accuracy (Art. 5(1)(d)).

Likely costs: Audits, remediation and claims; exposure up to £17.5m or 4%.

ICO/legal enforcement: ICO enforcement – ICO AI guidance warns failures here undermine fairness and invite enforcement.

User‑facing explanations added to notices/UX where appropriateYesNoN/A

Risk: People may be subject to automated decisions without safeguards, breaching Art. 22.

Likely costs: Investigations, redesign; fines up to £17.5m or 4%.

ICO/legal enforcement: ICO enforcement – Experian received an Enforcement Notice for profiling/ADM transparency failures.

Where shall we send this report too? *Please enter your email address

FAQs

Navigation

Learnings

Thanks for taking part

FAQs

How long does it take?

Will I need legal knowledge?

Do I get my results?

Is this legal advice?

Governance and Accountability

Navigation

Learnings