UK GDPR due diligence | A guide for data controllers

Knowledge Hub
for Growth

Article

6 mins read

Updated on 22 November 2024

Our subject expert
Lillian Tsang MBA

Senior Solicitor - Data Protection & Privacy

UK GDPR due diligence is a critical responsibility for data controllers who share personal data with external suppliers.

Whether you’re dealing with HR providers, cloud platforms or outsourced marketing teams, weak or inconsistent checks can expose your business to serious risks. Due diligence is more than a legal obligation – it’s a strategic safeguard that protects against breaches, fines, and reputational harm.

Done right, it reduces the chance of breaches, regulatory fines and reputational damage, and shows the ICO that you’re taking your accountability obligations seriously. If you're unsure how to structure your due diligence process or what level of scrutiny is appropriate, our data protection solicitors can help. We can advise you on tailored, sector-specific solutions that protect your data, satisfy your legal obligations and strengthen supplier relationships.

Why UK GDPR due diligence can make or break your compliance

As a data controller, your legal responsibility to ensure that processors protect personal data is crystal clear. But this goes far beyond a signed contract. If you fail to conduct proper checks, your business is at serious risk. Here are some important areas to consider:

The UK GDPR requires your business, as a controller, to ensure that any data processors you use protect the personal data you share with them. This obligation involves more than just giving processors a contract to sign—it demands a thorough, proactive assessment to safeguard your data from risks, such as data breaches and their potential consequences.
Contracts with data processors need to include specific terms (including about implementing appropriate security measures), but a contract alone is not enough, and due diligence is the first step.
The law requires data controllers to demonstrate ‘accountability.’ Your business should establish clear, documented procedures to continuously review and monitor your data processors. The ICO’s Accountability Framework outlines what this looks like in practice and highlights the need for proactive governance over any third-party processing of personal data. The level of scrutiny you apply should match the level of risk associated with the data processing activities they’ll be performing. You should therefore keep detailed records of the checks you’ve conducted to show that a processor you intend to use can safeguard your company’s personal data.

Your business should already have a due diligence questionnaire to address any due diligence needs promptly (e.g. where you’re looking to work with a new supplier with whom you need to share your customer details). A comprehensive questionnaire allows you to evaluate data processors systematically. Without one, your business may struggle with administrative challenges and be unprepared when assessing processors, increasing your exposure to risk.

By conducting thorough due diligence, you not only fulfil your legal obligations but also safeguard your business and its reputation.

The must-have checklist for supplier UK GDPR due diligence

When assessing suppliers, knowing where to focus can save you time and effort. Here are the non-negotiables:

Evaluating processor security: Security is a key principle of data protection law, and it should be a top priority for your business when assessing data processors. Check whether your processors have robust security measures in place to protect your data. Your business can request evidence of these security measures, such as audit results, penetration tests, or certifications like ISO 27001, which can help with GDPR compliance. Many suppliers may already have security documentation available or may introduce you to their technical team for further details.
Understand data handling processes: Your business should fully understand how a processor handles data, from collection and storage to deletion. They must process data according to your strict instructions. If their internal practices around data deletion can’t be adjusted for your needs, you’ll need to question if you’re comfortable working with them.
International data transfers: If personal data is sent outside of the UK, your business should verify how these transfers comply with UK GDPR international data transfer requirements. Understanding where and how data flows across borders can help you identify any additional compliance steps, such as the need for an International Data Transfer Agreement and Transfer Risk Assessment.
Deletion practices: Your business should ensure that data is securely deleted when no longer needed. If a processor can’t prove this, treat it as a red flag.
Sub-processor transparency: The use of sub-processors adds complexity. Your business should vet these relationships carefully to understand where your data is going and who else will have access to it. You can try to negotiate that processors must seek your specific approval before engaging sub-processors. Are there contracts in place with any sub-processors to ensure that your data is protected? Ask if the processor conducts audits on their sub-processors and how they manage sub-processor compliance.
Checking for a Data Protection Officer (DPO): Your business should verify whether the processor has a designated Data Protection Officer (DPO) or a dedicated person responsible for handling data protection matters. This can demonstrate a positive commitment to data protection.
Assessing governance and transparency. Review the processor’s commitment to data protection. Does your processor train staff regularly, keep comprehensive records of processors, and have clear protocols for reporting data breaches that affect your data? It is also helpful to check if the business has suffered any breaches.

While these are some common questions, your business should avoid a one-size-fits-all approach and tailor your questions to address specific risks for each contract.

Don’t let due diligence drag you down: streamline your process

As a controller, UK GDPR due diligence doesn’t have to weigh you down. With a smart approach, you can save time without cutting corners. Here are some practical tips on how your business can make your efforts effective and practical:

Tailor your questions and collaborate with processors: You can tailor your questionnaires to match the data processing activities of suppliers and the risk. For high-risk projects (e.g. where special category data will be processed), for instance, you can use in-depth questionnaires. For lower-risk cases where minimal personal data is involved, you can use a shorter version to streamline the process if you are confident that certain in-depth questions do not need to be explored and will only slow matters down. Your business should consider having templates ready for different risk levels to save time. However, always think closely about the particular risks associated with each project before rolling out a questionnaire. Trusted suppliers you’ve worked with for years might only need a quick assessment, while new or less established ones may require a deeper review. Be prepared to adjust your approach according to the sensitivity of the data being shared. You should also be aware that some suppliers may have their own due diligence information (e.g. questionnaires, pre-prepared compliance materials, or Q&A documents) that explain their data protection practices. Be prepared for this and approach the situation with an open and collaborative mindset. While you have a duty to ensure you get the answers needed to satisfy your UK GDPR obligations, you may find that these documents cover much of the information you require. However, it’s important to review them carefully and have an open discussion with the supplier if any of your specific questions remain unanswered or require further detail, or if you need them to complete your questionnaires. The aim here is to maintain a positive relationship while also ensuring that your compliance questions are fully addressed.
Ask for evidence: Verify supplier claims by requesting documentation, such as security audit reports or test results. This evidence can help you confirm that their security measures are more than just promises and help you justify why you’ve opted to work with them.
Review regularly: Schedule regular assessments to keep your compliance up to date. A regular review schedule will help your business catch potential issues early.

Don’t leave your business exposed: Make UK GDPR due diligence work for you

Due diligence doesn’t need to be burdensome – but it does need to be consistent, risk-focused, and well-documented. When you’re sharing personal data with third-party processors, the stakes are too high for a passive approach. Whether you need help reviewing supplier contracts, developing tailored questionnaires or streamlining your process across multiple departments, our data protection solicitors can support you at every stage. We’ll help you strike the right balance between compliance and efficiency so that you can manage your supplier relationships with clarity and confidence.

About our expert

Lillian Tsang MBA

Senior Solicitor - Data Protection & Privacy

Lillian is an experienced data protection, privacy and AI lawyer, who qualified in England and Wales in 2008. She helps businesses navigate complex and fast-changing data laws with confidence, combining technical expertise with practical, commercially focused advice.

View Profile 