United Kingdom: Controller/Processor Duties

The UK retains the full GDPR Chapter IV accountability architecture (Art. 5(2) and Art. 24 UK GDPR): controllers must implement Privacy by Design and by Default (Art. 25), maintain Records of Processing Activities (Art. 30 ROPA; SME exemption under 250 employees is disapplied whenever processing is not occasional, includes special categories, or is likely to result in a risk), execute mandatory Art. 28 processor contracts, designate a Data Protection Officer where Art. 37(1) triggers are met (or s.69 DPA 2018 for Part 3 competent authorities), and conduct Data Protection Impact Assessments (Art. 35 DPIA) for high-risk processing including entries on the ICO DPIA Blacklist (biometric/genetic data, large-scale profiling, child tracking, AI/innovative technology). note that earlier DPDI Bill proposals to replace DPOs with Senior Responsible Individuals (SRIs), replace DPIAs with Assessments of High Risk Processing, and abolish Art. 30 ROPAs were dropped and are NOT part of DUAA 2025. Personal data breaches must be notified to the ICO within 72 hours under Art. 33 UK GDPR unless unlikely to result in a risk; under DUAA 2025 s.110 (in force 5 February 2026), the PECR Reg. 5A telecommunications/ISP breach notification deadline is harmonised from 24 hours to 72 hours.