Your checklist. Work through it with your legal, IT and operations teams.
Know your data List every place you collect personal data: website, app, WhatsApp, SMS, paper forms and field teams. Section 3 For each, write down the purpose and the data you actually need. Section 4, Section 6(1) Mark which uses need consent and which are legitimate uses without it. Section 7 List the Data Processors who handle data for you, and sign contracts with them. Section 8(2) Notice and consent Write a plain notice that lists the data, each purpose, and how to withdraw and complain. Section 5, Rule 3 Offer the notice in English and the languages your people read. Section 5(3), Section 6(3) Ask for each purpose separately, with a clear action to agree. No pre-ticked boxes. Section 6(1) Keep proof of each consent: the notice shown, the time and how they agreed. Section 6(10) Send a notice to people who consented before the Act applied. Section 5(2) Bring paper forms into the same process and record. Section 3 Withdrawal and rights Make withdrawal as easy as giving consent, on the same channel. Section 6(4) Stop processing, and tell your processors, when consent is withdrawn. Section 6(6) Set up a way to answer access requests with a summary of the data and who it was shared with. Section 11 Set up correction, completion, updating and erasure requests. Section 12 Let people name a nominee. Section 14, Rule 14 Publish how to raise a grievance, and answer within 90 days. Section 13, Rule 14 Children and guardians Find out where you collect data from people under 18. Section 9 Get verifiable consent from a parent, and check they are an identifiable adult. Rule 10 Stop tracking, behavioural monitoring and targeted ads aimed at children. Section 9(3) For a person with a disability, check that the guardian was lawfully appointed. Rule 11 Security, breaches and retention Put security safeguards in place: encryption, access control, logs and backups. Section 8(5), Rule 6 Keep logs for at least one year. Rule 6, Rule 8 Write a breach plan: tell the Board without delay, report within 72 hours, and tell each person. Section 8(6), Rule 7 Set how long you keep data for each purpose, and erase it when the purpose is served. Section 8(7), Rule 8 Publish the contact details of your Grievance Officer or DPO. Section 8(9), Rule 9 
by
