Skip to main content
Currently accepting diagnostic bookings. Same-week availability. Book the Free Diagnostic →

Framework · Data protection

GDPR readiness and ISO 27001

How ISO 27001 supports the security duties in the UK GDPR, and where this fits at Goldline.

Book the Free DiagnosticAbout our approach

The UK GDPR, read with the Data Protection Act 2018, governs how UK organisations use personal data. Article 32 requires security appropriate to the risk. That is where an information security management system helps.

Where this framework fits at Goldline

Goldline's data protection services are the Outsourced DPO, the Integrated DPIA and AI Impact Assessment, and the security side of UK GDPR through the ISO 27001 Sprint, and ISO 27701 privacy management. Two published services touch UK GDPR work:

  • The ISO 27001 Sprint, £7,000 fixed, plus VAT, for a single legal entity with up to 50 people in scope, one site or cloud hosted. It builds the information security management system that can hold the evidence for the security measures in Article 32.
  • The Integrated DPIA and AI Impact Assessment, from £4,000, plus VAT: one combined assessment for a high-risk processing or AI use case.

Where AI governance is also in scope, the Integrated Sprint (ISO 27001 with ISO 42001) is £12,500 fixed, plus VAT. See the ISO 42001 guide and every published price.

For active engagement, book a free 45 minute diagnostic and we will confirm whether the ISO 27001 Sprint (or, where AI governance is also in scope, the ISO 42001 Sprint) fits your specific circumstances.

Book the Free Diagnostic
Browse all frameworks

What Article 32 asks for

Article 32 of the UK GDPR requires controllers and processors to put in place technical and organisational measures that give security appropriate to the risk, including as appropriate:

  • pseudonymisation and encryption of personal data
  • the ongoing confidentiality, integrity, availability and resilience of processing systems
  • the ability to restore access to personal data in a timely manner after an incident
  • a process for regularly testing, assessing and evaluating the effectiveness of those measures

Infringing these obligations carries fines of up to £8.7 million or, for an undertaking, 2% of total worldwide annual turnover, whichever is higher. The higher tier, up to £17.5 million or 4%, applies to matters such as the processing principles, data subject rights and international transfers.

What changed with the Data (Use and Access) Act 2025

The Act received Royal Assent on 19 June 2025. Most of its data protection provisions came into force on 5 February 2026, and the regulator confirms that all provisions affecting data protection law are now in force. It amends the UK GDPR rather than replacing it. Changes include:

  • a new "recognised legitimate interests" lawful basis
  • a duty to help people make data protection complaints, acknowledge them within 30 days and respond without undue delay
  • a reworded test for transfers outside the UK
  • from 30 September 2026, the Information Commission (formerly the Information Commissioner's Office, ICO) took over the functions of the Information Commissioner

Frequently asked

Goldline's data protection services are the Outsourced DPO, the Integrated DPIA and AI Impact Assessment, and the security side of UK GDPR through the ISO 27001 Sprint, and ISO 27701 privacy management. Outsourced DPO.

ISO 27001 is an information security standard. It gives you a managed way to choose, run and test security controls and keep the evidence, which is the kind of record Article 32 expects. It does not cover the rest of the UK GDPR, such as lawful basis, transparency or individual rights. Read how to choose an ISO 27001 consultant.

A notifiable breach must be reported to the regulator without undue delay and not later than 72 hours after becoming aware of it. Where a breach is likely to create a high risk to individuals, you must also tell them directly and without undue delay.

Article 37 of the UK GDPR requires one where processing is carried out by a public authority or body, or where your core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special category data or criminal convictions and offences data. If you appoint one voluntarily, see our Outsourced DPO.

Every restricted transfer needs UK adequacy regulations, an appropriate safeguard such as the International Data Transfer Agreement (IDTA), the International Data Transfer Addendum or UK binding corporate rules, or an exception under Article 49. When you rely on a safeguard, you must also complete a transfer risk assessment.

Discuss where this framework fits your programme

Book the Free Diagnostic to confirm whether the ISO 27001 Sprint fits your circumstances.

Book the Free Diagnostic

We use cookies to measure the site and improve it.

Book the Free Diagnostic