Document library

Data and privacy pack

Under UK GDPR a personal data breach likely to risk people's rights must be reported to the ICO within 72 hours, and a subject access request answered within one month. Both deadlines are missed most often by businesses with no written procedure to follow on the day.

Core pack · 11 documents · 68 pages

The short answer

Who this pack is for

Any UK business holding customer or staff records, which is all of them
Ecommerce and service businesses handling online enquiries
Employers storing HR files, payroll and health information
Businesses asked for a data processing agreement by a larger client
Anyone who has received a subject access request and does not know the deadline

Not for you if: You are a large organisation required to appoint a statutory data protection officer and need bespoke governance.

What it solves

A customer asks for everything you hold on them and the clock starts.

A laptop is lost and nobody knows whether the ICO must be told.

A corporate client refuses to sign until you produce a processor agreement.

What the law requires

Breaches: 72 hours

A personal data breach must be reported to the ICO without undue delay and within 72 hours of becoming aware, unless it is unlikely to risk people's rights. High risk breaches must also be told to the individuals. A breach log is required whether or not the breach is reportable.

Source: ICO, personal data breaches guidance

Subject access: one month, usually free

You must respond within one calendar month, extendable by two months for complex requests. There is no fee except where the request is manifestly unfounded or excessive. Identity checks pause the clock only if made promptly.

Source: ICO, right of access guidance

You must know what you hold

Most organisations must keep a record of processing activities covering purposes, categories of data, recipients, transfers and retention. It is the first document the ICO asks for, and it is what makes a retention schedule possible.

Source: ICO, documentation and ROPA guidance

What is in the pack

ID	Document	Pages
DAT-01	Privacy notice (customers)ICO privacy notice checklist	6
DAT-02	Privacy notice (employees)ICO employment practices guidance	6
DAT-03	Cookie policy and consent textPECR; ICO cookies guidance	4
DAT-04	Data retention scheduleICO storage limitation	5
DAT-05	Record of processing activitiesUK GDPR Article 30	7
DAT-08	Subject access request procedure and lettersICO right of access	8
DAT-09	Breach log and response planICO breach reporting	6

And four more: data protection policy, DPIA template, data processor agreement, staff training record.

How updates work

Every document carries a version number and a reviewed date. On the first Tuesday of each month the pack is checked against its primary sources. If anything has changed you receive the updated file and one line explaining what moved and why. If nothing has changed you receive an email saying so.

April and the Budget are the months when most figures move.

Questions

Do I need a data protection officer?

Most small businesses do not. A DPO is required for public authorities and for large scale monitoring or special category processing. The pack includes a named data contact instead.

Is a cookie banner enough?

No. Non-essential cookies need consent before they are set, and the policy has to describe them. The pack includes the policy text and the consent wording.

Does this cover EU customers?

The documents are written for UK GDPR. If you offer goods or services into the EU you may also need an EU representative, which is outside this pack.

What if I use cloud tools like Google or Microsoft?

Those are processors. The pack includes the processor agreement template and a supplier list for your ROPA.

How is it delivered?

By email, as Word and PDF files, personalised with your company details.

Sources

Built from published UK primary sources only: ICO, documentation and ROPA guidance, ICO, personal data breaches guidance, ICO, right of access guidance. No secondary or aggregator sources are used.

Enquire about the data and privacy pack

Send an enquiry with your company name and sector. We confirm the order and invoice you, then merge your details into all 11 documents and email the pack to you.

Enquire: pack with 12 months of updates · £219 Enquire: documents only, no updates · £129

Templates, not legal advice, licensed for one business. Payment is by invoice, in pounds. If you are buying for an association, say so in the form below.

Questions, or buying for an association? licence

Questions before you buy? Write to us and we will answer the same day.

Email support@kaeltripton.com

Other packs in the library

Employment essentials packUK employers must give every employee a written statement of particulars on or before their first day, keep a right to work check on file before employment starts, and follow the ACAS Code before dismissing anyone. A tribunal can add up to 25% to an award where the Code is not followed. HR compliance packSince October 2024 UK employers have a positive duty to take reasonable steps to prevent sexual harassment at work, and a tribunal can uplift compensation by up to 25% where they have not. Written policies, a reporting route and a training record are the evidence that the duty was met. Data and privacy packUnder UK GDPR a personal data breach likely to risk people's rights must be reported to the ICO within 72 hours, and a subject access request answered within one month. Both deadlines are missed most often by businesses with no written procedure to follow on the day. Health and safety packEvery UK employer must manage health and safety risks, and any employer with five or more staff must have the policy in writing. Certain injuries, diseases and dangerous occurrences must be reported to the HSE under RIDDOR, with fatal and specified injuries reported without delay. Commercial contracts packUK businesses can charge statutory interest on late commercial payments at 8% above the Bank of England base rate, plus a fixed sum of £40 to £100 per invoice, without agreeing it in advance. Most never claim it because the contract and the letter chain are not in place. Finance and tax admin packMaking Tax Digital for Income Tax starts from April 2026 for sole traders and landlords with qualifying income above £50,000, dropping to £30,000 from April 2027. Quarterly updates replace the single annual return, and records must be kept digitally. Business operations packBusinesses with turnover above £36 million must publish a modern slavery statement, and any organisation using AI on personal data must be able to explain the processing under UK GDPR. Most smaller firms are asked for both by corporate customers long before the law requires them. New business starter packA new UK employer must register as an employer with HMRC before the first payday, hold employers liability insurance of at least £5 million, and complete a right to work check before the first day. Missing employers liability cover alone can cost £2,500 for every day uninsured. Letting and estate agency packLetting agents in England must belong to a government approved redress scheme, hold client money protection, and complete a right to rent check on every adult occupier before a tenancy starts. Renting to someone without the right to rent can cost up to £20,000 per tenant. Care providers packA care provider holding a sponsor licence must keep a right to work file, absence records and up to date contact details for every sponsored worker, and report most changes to the Home Office within ten working days. Licence revocation stops international recruitment immediately. Hospitality and food packEvery UK food business must have a documented food safety management system based on HACCP principles, and since October 2024 all qualifying tips must be passed to workers in full with a written policy available to staff. Food hygiene ratings are published, so the paperwork is public facing. Construction and subcontractors packUnder CDM 2015 every construction project has duty holders, and any project lasting more than thirty working days with more than twenty workers at once must be notified to the HSE. Contractors in CIS must verify every subcontractor with HMRC before the first payment. Plumbing, heating and trades packAnyone working on gas appliances in the UK must be on the Gas Safe Register, and landlords must hold an annual gas safety record for every appliance. Consumer contracts agreed in a customer's home carry a fourteen day cancellation right that most trades never mention in writing. Retail and ecommerce packOnline sellers must give consumers a fourteen day cancellation right and prescribed pre-contract information, and refund within fourteen days of goods being returned. Faulty goods carry a thirty day short term right to reject that cannot be excluded by a returns policy. Transport, courier and logistics packOperators of goods vehicles over 3.5 tonnes need an O licence and must keep maintenance records for fifteen months, with drivers hours and tachograph records kept for at least a year. Traffic commissioners act on record failures as readily as on roadworthiness. Beauty and personal care packTreatment records including health information are special category data under UK GDPR, so they need a lawful basis, a retention period and secure storage. Insurers also require a signed consultation and, for many treatments, a patch test recorded before the appointment. Cleaning services packCleaning products are covered by COSHH, so employers must assess exposure and keep safety data sheets available to staff. Cleaners frequently work alone and out of hours, which is the risk most commonly missing from a small contractor's paperwork. Childcare and nurseries packThe EYFS statutory framework sets minimum staff to child ratios of one to three for under twos, one to four for two year olds and one to thirteen for three year olds and over with a qualified teacher. Every setting must have a designated safeguarding lead and written safeguarding procedures. Professional services packAccountancy and bookkeeping businesses must be supervised for anti money laundering, either by a professional body or by HMRC, and must carry out client due diligence before acting. An engagement letter defining scope is the single document that prevents most fee and liability disputes. Right to work and right to rent audit packIllegal working civil penalties in the UK now reach £45,000 per worker for a first breach and £60,000 for repeat breaches, with right to rent penalties up to £20,000 per tenant. A correctly completed and retained check is the only statutory excuse. Redundancy and restructure packProposing twenty or more redundancies at one establishment within ninety days triggers collective consultation, with a minimum of thirty days before the first dismissal, rising to forty five days at one hundred or more. Failure can cost a protective award of up to ninety days pay per employee. First employee packBefore a first employee starts, a UK business must register as an employer with HMRC, hold employers liability insurance of at least £5 million, complete a right to work check and issue written terms on or before day one. The uninsured penalty alone is up to £2,500 per day. Moving to the UK with family packMost people applying to settle in the UK must show no more than 180 days outside the UK in any twelve month period across the qualifying years, and school places in England must be applied for through the local council rather than the school. Both catch new arrivals out in the first year.

See the full document library

Templates, not advice

These documents are drafted from published UK primary sources and are a starting point you adapt to your own circumstances. They are not legal, tax or immigration advice, and documents you edit become your responsibility.

Editorial standards How we make money Contact