---
title: "United Kingdom — Controller/Processor Duties | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-kingdom/controller-processor-duties/
source_html: /jurisdictions/united-kingdom/controller-processor-duties/index.html
description: "United Kingdom — Controller/Processor Duties (Amber, 7 sub-modules, 9 claims): Framework is mature and enforced, but amber reflects live enforcement activity indicating gaps in DPIA and security practice among controllers, and ongoing DUAA-"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 4365272b41b1f8683afab8854ab10de9555a4111fd95d35eca15b004b4c70954
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — Controller/Processor Duties | Data Protection Monitor

### D4Controller/Processor Duties7 sub-modules9 claimsAmber▾#

Framework is mature and enforced, but amber reflects live enforcement activity indicating gaps in DPIA and security practice among controllers, and ongoing DUAA-driven guidance updates.

Primary framework UK GDPR Articles 5, 24-39; DPA 2018

Supervisory authority [Information Commissioner's Office (ICO)](https://ico.org.uk/)

Traffic-light rationale — Amber Framework is mature and enforced, but amber reflects live enforcement activity indicating gaps in DPIA and security practice among controllers, and ongoing DUAA-driven guidance updates.

#### Sub-modules (7)

#### Key findings (1)

- South Staffordshire Water fined £963,900 for Article 32 security failures. — [South Staffordshire Plc and South Staffordshire Water Plc](https://ico.org.uk/action-weve-taken/enforcement/2026/05/south-staffordshire-plc-and-south-staffordshire-water-plc/)

Category narrative 197 words

The UK retains the full GDPR Chapter IV accountability architecture (Art. 5(2) and Art. 24 UK GDPR): controllers must implement Privacy by Design and by Default (Art. 25), maintain Records of Processing Activities (Art. 30 ROPA; SME exemption under 250 employees is disapplied whenever processing is not occasional, includes special categories, or is likely to result in a risk), execute mandatory Art. 28 processor contracts, designate a Data Protection Officer where Art. 37(1) triggers are met (or s.69 DPA 2018 for Part 3 competent authorities), and conduct Data Protection Impact Assessments (Art. 35 DPIA) for high-risk processing including entries on the ICO DPIA Blacklist (biometric/genetic data, large-scale profiling, child tracking, AI/innovative technology). note that earlier DPDI Bill proposals to replace DPOs with Senior Responsible Individuals (SRIs), replace DPIAs with Assessments of High Risk Processing, and abolish Art. 30 ROPAs were dropped and are NOT part of DUAA 2025. Personal data breaches must be notified to the ICO within 72 hours under Art. 33 UK GDPR unless unlikely to result in a risk; under DUAA 2025 s.110 (in force 5 February 2026), the PECR Reg. 5A telecommunications/ISP breach notification deadline is harmonised from 24 hours to 72 hours.

Evidence 9

Sources and claims (9)
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/) — Accountability is a UK GDPR principle requiring organisations to take responsibility for and demonstrate compliance, including through data protection by design/default, processor contracts, documented processing activities and DPIAs.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/reddit-issued-with-1447m-fine-for-children-s-privacy-failures/) — The ICO's £14.47m fine against Reddit found the company failed to carry out a DPIA to assess and mitigate risks to children before January 2025.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/imgur-owner-medialab-fined-over-children-s-privacy-failures/) — The ICO's £247,590 fine against MediaLab (Imgur) similarly found a failure to carry out a data protection impact assessment to identify and reduce privacy risks to children.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/) — Where an organisation has appointed a DPO, the DPO's contact details (and name, with consent) are published on the ICO's public register of fee payers.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/) — A DPO's tasks include advising the organisation about UK GDPR compliance, monitoring compliance and training staff.observed 2026-07-28
- Probable[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/) — Demonstrating accountability includes maintaining documentation of an organisation's processing activities, a measure the ICO expects controllers to adopt as part of governance.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-for-the-use-of-personal-data-in-political-campaigning-1/controllers-joint-controllers-and-processors/) — If two or more controllers jointly determine the purposes and means of processing the same personal data, they are joint controllers; they are not joint controllers where processing the same data for different purposes.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/action-weve-taken/enforcement/2026/05/south-staffordshire-plc-and-south-staffordshire-water-plc/) — The ICO imposed a £963,900 fine on South Staffordshire Plc and South Staffordshire Water Plc for infringing Article 5(1)(f) and Article 32(1) UK GDPR following a cyber incident exfiltrating personal data of approximately 633,887 UK data subjects.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/) — The DUAA aligns the timeline for notifying the Commissioner of a PECR security breach with the UK GDPR breach-notification timeline.observed 2026-07-28