Profile information Member settings
Sign up Sign in

Make your GDPR documents

Get started



Consider appointing a Data Protection Officer (DPO). This is the person responsible for ensuring data protection compliance within your business. The DPO should become familiar with data protection requirements and audit your data processing activities to ensure compliance.


Understand how the GDPR applies to you and your business. Any business that processes (eg stores or collect) personal data (ie identifiable information relating to individuals, such as names and addresses) must comply with the GDPR.


Only process personal data in accordance with the data protection principles. This means that you must be clear on what ‘processing’ is and what your business does with personal data (both internally and externally).


Ensure that you have a legal ground for processing any personal data. These include:


Where relevant, review your existing process for obtaining consent from data subjects and ensure consent is valid. You should keep some form of record of consent (ie how and when consent was given, and by whom).

Ensure that you offer a proper process for individuals to withdraw consent at any time and notify them of their right to do so. For more information, read Consent for GDPR.


Take extra care when processing sensitive personal data (eg information about racial or ethnic origin, sexual life or health) or criminal offence data (ie information about criminal convictions and offences), as these are subject to more stringent controls.


Consider if your processing of personal data is likely to result in a high risk to the rights and freedoms of individuals. If so, make a Data protection impact assessment (DPIA) to help you identify and minimise data protection risks.


Where a DPIA was carried out, determine if an Appropriate policy document (APD) is needed.

An APD outlines your procedures for ensuring compliance with data protection principles in relation to any sensitive personal or criminal offence data processes. Read Appropriate policy documents for more information.


Ensure that you comply with data protection laws when dealing with staff personal data.

Make a Data protection policy to inform your employees how you use their data and what principles they must adhere to when handling personal data.

Consider informing anyone working for you about the types of data you may collect about them and what you do with it, using:


Make a Website privacy policy that indicates what personal data is being collected on your website, the purpose of collection, and how individuals can access this data.


Ensure you are aware of your obligations when data subjects make a data protection request (eg asking for their data to be erased or corrected), including what steps you have to take and how long you have to respond.


Be sure to understand the laws and regulations around international transfers of personal data and to only transfer personal data outside the UK where adequate data transfer mechanisms (eg standard contractual clauses) have been put in place.


If you are outsourcing data processing to a third party (eg a third-party service provider), make a Data processing agreement (DPA) to ensure the safety of the personal data.


Understand your obligations for reporting a data breach (ie a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data).

Consider appointing a specific person or setting up a dedicated team to deal with data breaches.


Train staff to ensure that everyone is aware of relevant data protection procedures and the responsibility everyone has.


Keep records of your processing activities (including why you are processing certain personal data, how long personal data will be retained and who it will be shared with) and review them regularly.


Bear in mind that you may need to comply with the European Union’s (EU) General Data Protection Regulation if you are processing personal data belonging to anyone based in the EU. For more information, Ask a lawyer.



For more information, read Data protection for businesses and Complying with the GDPR, and do not hesitate to Ask a lawyer if you have any questions or concerns.

Ask a lawyer

Get quick answers from lawyers, easily.
Characters remaining: 600
Rocket Lawyer On Call Solicitors

Try Rocket Lawyer FREE for 7 days

Get legal services you can trust at prices you can afford. As a member you can:

Create, customise, and share unlimited legal documents

RocketSign® your documents quickly and securely

Ask any legal question and get an answer from a lawyer

Have your documents reviewed by a legal pro**

Get legal advice, drafting and dispute resolution HALF OFF* with Rocket Legal+

Your first business and trade mark registrations are FREE* with Rocket Legal+

**Subject to terms and conditions. Document Review not available for members in their free trial.