ExternalOS

The problem: most UK businesses are not GDPR compliant

Every UK business processing personal data needs GDPR documentation. Solicitors charge £500-2,000 for a privacy policy alone. A full compliance pack runs into thousands. Free online generators produce generic, surface-level policies that miss sector-specific requirements and rarely cover the full document set. The ICO can fine up to £17.5 million or 4% of global turnover.

  • Most small businesses have a copied privacy policy and nothing else, no ROPA, no DPIAs, no breach response plan
  • No records of processing activities (Article 30 obligation for all businesses)
  • Subject Access Requests with no response procedure - 30-day deadline with no system
  • Data breaches with no 72-hour ICO notification procedure in place

14 document types generated

  • Website Privacy Policy. UK GDPR and PECR compliant, with processing purpose tables
  • Privacy Notices, separate versions for employees, customers, and suppliers
  • Cookie Policy, with cookie audit table and consent mechanism guidance
  • Data Processing Agreement, controller-processor, Article 28 compliant
  • Records of Processing Activities (ROPA). Article 30 register
  • Data Protection Impact Assessment (DPIA) - full risk assessment template
  • Legitimate Interest Assessment (LIA). ICO three-part test
  • DSAR Response Templates - 30-day deadline compliant with exemption guidance
  • Data Breach Notification. ICO 72-hour report and data subject notification
  • Data Retention Schedule, by category with legal justifications
  • International Data Transfer documentation. UK adequacy decisions, IDTA, SCCs

Sector-specific presets

The documents adapt to your business type. E-commerce businesses get payment processing clauses, marketing soft opt-in, and fraud detection documentation. SaaS companies get sub-processor management and DPAs for enterprise customers. Healthcare gets special category data handling and Caldicott Principles compliance. Recruitment and HR gets CV retention limits, DBS check documentation, and AI screening DPIAs.

These are GDPR compliance document templates based on UK GDPR, the Data Protection Act 2018, and ICO guidance. Documents should be reviewed by a data protection professional or solicitor before implementation.