GDPR Policy Template for UK Businesses
UK GDPR compliance requires more than one document. Get a complete set of data protection policies tailored to your business — covering UK GDPR, the DPA 2018, and the Data (Use and Access) Act 2025.
Instant PDF & Word download · 14-day money-back guarantee
What GDPR documents does your business need?
UK GDPR compliance is not a single document — it requires a suite of policies covering how your business collects, uses, stores, and protects personal data. The core requirements for most UK small businesses are:
- Privacy Policy — external document explaining to customers how you use their data
- Data Protection Policy — internal document for staff covering your data handling procedures
- Data Retention Policy — sets out how long you keep different types of data
- Employee Privacy Notice — explains to staff how you process their personal data
Larger businesses or those handling sensitive data may also need a Data Breach Response Procedure and Subject Access Request Procedure, both included in our Professional plan (£69).
The Data (Use and Access) Act 2025
The DUAA 2025 received Royal Assent in June 2025 and introduced important updates to UK data protection law, with key provisions taking effect from February 2026. All our documents are generated to reflect these changes.