UK GDPR for software products: what a compliant build includes in 2026

What changed in 2026

• The Data (Use and Access) Act 2025 is now largely in force: most of its data protection changes started on 5 February 2026.
• On 30 September 2026 the Information Commissioner's Office was replaced by the Information Commission, which took over its functions.
• Cookies: consent is no longer needed for a short list of purposes, including analytics used only to improve your service, provided users are told clearly, can object easily and for free, and the analytics provider acts only as your processor, with no advertising or profiling.
• Complaints: you must give people an easy way to complain about how you use their data, such as an online form, and acknowledge complaints within 30 days.
• Fines under the electronic communications rules (PECR), which cover cookies and marketing, now reach UK GDPR levels: up to £17.5 million or 4 percent of global turnover.
• Automated decisions: products may make significant decisions about people by automated means on any lawful basis, with safeguards: tell people, let them make representations, offer human review and let them contest the result. Special category data still has stricter rules.
• Transfers: the test for sending personal data abroad is now whether protection at the destination is "not materially lower" than in the UK.
• Recognised legitimate interests: a short list of purposes, such as preventing crime, safeguarding and emergencies, no longer needs a balancing test.

The build checklist

1. A lawful basis for each purpose, written down. Most product processing runs on contract or legitimate interests. Where consent is the basis, record what the person agreed to, which wording, when and how, keep the record append-only, and make withdrawing as easy as agreeing.
2. Data minimisation by design. Collect the fields the workflow needs and nothing speculative; the UK GDPR requires data protection by design and by default (Article 25).
3. Access by role, enforced in the database. Users see their own organisation's data and nothing else, with row-level security as the boundary rather than the interface. Staff see what their role needs, and admin actions are logged.
4. Encryption in transit everywhere and at rest for stored data, with field-level encryption for the most sensitive values and keys held in a managed key service.
5. An audit trail written by the database on every change to personal data, which the application itself cannot edit or delete.
6. Request tooling. Export everything held about a person in a usable format, correct it, restrict it or delete it on request, and track each request against the one-month deadline, which can be extended by two months for complex or numerous requests.
7. Erasure that keeps the records you must keep. Deleting a user should free their identity while business records stay attributed to a deleted user, so audit and accounting history survive.
8. Retention enforced by code: a written schedule of what is kept, for how long and why, and scheduled jobs that delete or anonymise on time.
9. Breach readiness: monitoring and alerts, a written process, and the ability to report a notifiable breach to the regulator within 72 hours of becoming aware of it, and to tell affected people without undue delay when the risk to them is high.
10. Processors: an Article 28 contract with every service that handles personal data for you (hosting, email, payments, analytics, support tools), and a register kept current.
11. Transfers: a map of where personal data goes, including any supplier's staff who can reach it from abroad, with the IDTA or the UK Addendum and a transfer risk assessment wherever there is no adequacy regulation.
12. Cookies and tracking: strictly necessary cookies and the new exempt purposes without consent, with the information and objection route the exemptions require; anything for advertising or profiling behind consent.
13. A complaints route: an online form or address for data protection complaints, acknowledged within 30 days.
14. Safeguards for automated decisions, if the product makes significant decisions about people without a human: notice, a way to make representations, human review and a way to contest.
15. A data protection impact assessment before building anything likely to be high-risk: large-scale special category data, systematic monitoring, or new technology applied to people.

Retrofitting is where compliance gets expensive. Every item above is cheap in the first migration and costly once the data model, the users and the integrations exist.

What is not the developer's job

Choosing your lawful bases, writing the privacy notice, keeping records of processing, appointing a data protection officer if you need one, paying the data protection fee (£52 a year for most small organisations) and signing processor contracts are yours, with your adviser. A good studio builds the behaviours above, puts the right wording in front of users at the right moments, and supplies the technical half of a DPIA.

Selling into the EU as well

If you offer your product to people in the EU, the EU GDPR applies alongside the UK's. The two are still close, and a build that meets the checklist meets most of both. The differences that bite: without an establishment in the EU you usually need an EU representative; EU cookie rules have no general analytics exemption like the UK's new one, so EU visitors usually need a consent banner for analytics; and transfers from the EU to your suppliers need the EU's own standard contractual clauses. Data flows freely from the EU to the UK, because the EU renewed the UK's adequacy decision in December 2025.

How it looks in real builds

For ARC Legacy, an encrypted digital vault built for South Africa's POPIA, the same principles are the product: consent recorded at registration, documents encrypted in the application under per-vault keys held in a managed key service, an append-only audit log enforced by the database, export and deletion with a countdown, and a retention schedule that says what survives and why. For KlarOK, a Swedish compliance platform under the EU GDPR, the plan we are delivering includes permanent user deletion that frees the username while every form stays attributed to a deleted user, and view profiles that decide what each user can see, enforced everywhere a form can be reached.

What it costs

Building the checklist in from the start adds roughly fifteen to twenty-five percent to a comparable product without it, mostly in the data model, the audit log and the request tooling. Retrofitting it later costs a multiple of that. See what bespoke software costs in the UK.

Building with Niddo

If your product holds personal or financial data, we scope the compliance layer with the rest of the build and price it as one figure, in pounds for UK companies. See how we work with UK companies, or tell us what you are building.