UK GDPR / DPA 2018 / DUAA 2025 compliance, ICO fee, international transfers.

• VII.1

  Confirm UK GDPR / DPA 2018 governance: appointed DPO or accountable lead identified.[DPA 2018]

  Severity B
• VII.2

  Obtain Record of Processing Activities (ROPA) and confirm currency.[DPA 2018]

  Severity B
• VII.3

  Review DPIA register for high-risk processing.

  Severity B
• VII.4

  Confirm ICO data-protection fee paid for the current year (Tier 1 £52 / Tier 2 £78 / Tier 3 £3 763 inc £5 DD discount).[ICO fee]

  Severity B
• VII.5

  Confirm DUAA 2025 Part 5 alignment for any digital-verification or smart-data processing (in force 5 Feb 2026).[DUAA 2025]

  Severity B
• VII.6

  Obtain processor agreements (Art 28) for all material data processors.

  Severity B
• VII.7

  Confirm international transfers covered by UK IDTA or Addendum; record adequacy decisions relied on.[DPA 2018]

  Severity B
• VII.8

  Confirm EU-UK adequacy decision renewal (eff. 19 Dec 2025, runs to 27 Dec 2031).

  Severity C
• VII.9

  Review breach register and any reportable incidents within the last six years.

  Severity A
• VII.10

  Confirm any ICO enforcement action, audit or undertaking.

  Severity A
• VII.11

  Review privacy notice currency on website and customer-onboarding flows.

  Severity C
• VII.12

  Confirm cookie-consent banner compliance with PECR.

  Severity C
• VII.13

  Review subject-access-request log for response-time compliance.

  Severity C
• VII.14

  Confirm staff data-protection training cadence and completion records.

  Severity C
• VII.15

  Identify any third-country data flows requiring transfer-risk assessment.

  Severity B
• VII.16

  Confirm data-retention schedule and evidence of deletion practice.

  Severity B