UK Data Protection Act 2018
Evidence request list. 12 controls, 12 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 12 September 2026. Published by The Art of Service.
General Processing (Part 2)
UK-specific conditions for processing special categories of data beyond UK GDPR Article 9 including employment, health research, archiving, and substantial public interest conditions.
- Documented procedure addressing lawful bases and conditions
- Evidence of executive or risk owner approval
- Operational records demonstrating execution
- Independent assurance or review report
- Procedure exists but execution inconsistent
- Owner accountability not codified
- Review cadence missed or undocumented
- Coverage gaps for in scope entities or systems
ICO may issue information notices, assessment notices, enforcement notices, and penalty notices. Maximum fines: GBP 17.5 million or 4% of annual worldwide turnover for highest tier violations.
- Legal register tracking enforcement risk
- Counsel opinion on liability exposure
- Self disclosure decision records
- Insurance coverage evidence
- Legal register not refreshed for new enforcement actions
- Director and officer awareness thin
- Self disclosure protocols undefined
- Cooperation credit strategy absent
Consent age for information society services in the UK is 13 (UK derogation from GDPR default of 16). Controllers must make reasonable efforts to verify parental consent for under-13s.
- Consent capture mechanism design records
- Consent log with timestamp and purpose linkage
- Withdrawal workflow evidence
- Privacy notice version aligned to consent text
- Bundled consent across distinct purposes
- Withdrawal not as easy as granting consent
- Records lack granularity per processing purpose
- Children consent thresholds not enforced
Exemptions for journalism, academic, artistic, and literary expression. National security certificate provisions. Immigration exemption for data subject rights.
- Documented procedure addressing uk-specific exemptions
- Evidence of executive or risk owner approval
- Operational records demonstrating execution
- Independent assurance or review report
- Procedure exists but execution inconsistent
- Owner accountability not codified
- Review cadence missed or undocumented
- Coverage gaps for in scope entities or systems
ICO
Per UK DPA 2018: Information Commissioner powers + enforcement + administrative fines.
- UK DPA 2018 evidence for UKDPA-4
- intelligence + LED + AADC partial
Law Enforcement Processing (Part 3)
Law enforcement processing must be lawful, fair, for specified purposes. Data must be adequate, relevant, not excessive, accurate, and kept no longer than necessary.
- Legal register tracking enforcement risk
- Counsel opinion on liability exposure
- Self disclosure decision records
- Insurance coverage evidence
- Legal register not refreshed for new enforcement actions
- Director and officer awareness thin
- Self disclosure protocols undefined
- Cooperation credit strategy absent
Data subjects have rights to information, access, rectification, erasure, and restriction. Rights may be limited where necessary and proportionate for law enforcement purposes.
- Data subject rights request intake workflow
- Identity verification procedure for requesters
- Response register with SLA timestamps
- Template responses approved by privacy office
- SLA breaches not tracked or escalated
- Identity verification inconsistent across channels
- Processor downstream actions not orchestrated
- Exemption decisions undocumented
Transfers of law enforcement personal data outside the UK require adequacy decision, appropriate safeguards, or specific conditions. Enhanced safeguards for sensitive data.
- Transfer impact assessment per destination
- Standard contractual clauses or equivalent
- Supplementary measures evidence
- Recipient list with onward transfer terms
- TIA missing for high risk destinations
- Supplementary measures asserted but not implemented
- Onward transfer obligations unmonitored
- Reliance on outdated adequacy decision
Part 3 Law Enforcement
Per UK DPA 2018 Part 3: law enforcement processing per LED. Different rules from general processing.
- UK DPA 2018 evidence for UKDPA-2
- intelligence + LED + AADC partial
Part 4 Intelligence
Per UK DPA 2018 Part 4: intelligence services processing. Modified protections per national security.
- UK DPA 2018 evidence for UKDPA-3
- intelligence + LED + AADC partial
Scope
Per UK Data Protection Act 2018 Parts 1-2: UK GDPR + general processing + scope.
- UK DPA 2018 evidence for UKDPA-1
- intelligence + LED + AADC partial
Specific Topics
Per UK DPA 2018: Children and AADC + Automated Decision Making Safeguards + Personal Data Breach Notification + International Transfers + Interface with NIS Regulations.
- UK DPA 2018 evidence for UKDPA-5
- intelligence + LED + AADC partial
Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does. See the UK Data Protection Act 2018 framework page.