Running a Compliant Business

Is My Business Compliant?

A plain-language self-check across the key areas of the Act, so you know where you stand and what to fix first.

Beginner 12 min

This module is general information, not legal advice, and is being reviewed by our legal team. For your specific situation, consult the official Data Protection Act, 2020 or seek professional advice.

What you will learn

The key areas the Act expects you to cover
A simple way to check where you stand
How to prioritise the gaps you find
Where to go next for each area

Overview

Compliance can feel vague until you break it into concrete areas. This module is a plain-language self-check across the parts of the Act that matter most for everyday businesses. Work through it honestly, note your gaps, and tackle them in order of risk.

Why this matters

You cannot fix what you have not measured. A quick, structured self-check shows you where you stand and stops you from spending effort on the wrong things.

The self-check

Go through each area and ask whether you can answer "yes" with confidence.

Know your data

Do you know what personal data you hold, where it lives, and why? See What is Personal Data?

Be transparent

Do you have a clear, current privacy notice that people can find? See How to Create a Privacy Notice.

Have a lawful basis

For each use of personal data, do you know your lawful basis? See Do I Need Consent?

Respect people's rights

Could you handle an access or correction request calmly and on time? See Understanding Data Subject Rights.

Keep data secure

Are access controls, backups, and basic security in place? This is the seventh standard.

Manage processors

Do you know who processes data for you, and do you have written contracts? See Who is a Data Controller?

Set retention

Do you delete or securely dispose of data you no longer need?

Plan for breaches

Do you have a simple plan for when something goes wrong? See What to Do If You Have a Data Breach.

Tip. Score yourself honestly. Three or four confident "yes" answers is a solid start. Turn each "no" into a small, dated task.

How to prioritise

Fix the highest-risk gaps first. For most small businesses that means, in rough order:

A clear privacy notice.
Basic security around your most sensitive data.
A plan for requests and breaches.
Retention and processor housekeeping.

Legal note. Some requirements, such as registration or whether you need a Data Protection Officer, depend on your specific activities. Confirm these against the Act or with counsel.

Common mistakes

Trying to fix everything at once and stalling.
Treating compliance as a one-time project rather than an ongoing habit.
Ignoring the basics (a notice, security) while polishing minor details.

Best practices

Repeat this self-check at least once a year.
Keep a simple action list with owners and dates.
Re-check whenever your business adopts a new tool or data use.

Put this into practice

Use the platform tools to turn this self-check into concrete, tracked actions.

Run a compliance check

Frequently asked questions

No. Start with the highest-risk gaps, usually a missing privacy notice, weak security, or no plan for requests and breaches.

Key takeaways

Compliance is a set of practical habits across a handful of areas.
Use this self-check to find your biggest gaps, then close them one by one.
You do not have to be perfect overnight. Steady progress is what matters.
Each area links to a module or tool that helps you act.

Getting Started

Understanding the Eight Data Protection Standards