UK GDPR: what it covers and how DOCNUS assesses documents against it

The UK GDPR is the version of the General Data Protection Regulation that applies in the United Kingdom, read alongside the Data Protection Act 2018 (DPA 2018). Since 2025 it has also been amended by the Data (Use and Access) Act 2025 (DUAA). This page explains the parts that matter most when you hold documents full of personal data, and exactly what DOCNUS does and does not check.

What counts as personal data

Article 4(1) defines personal data as "any information relating to an identified or identifiable natural person ('data subject')". A person can be identifiable directly or indirectly, for example by a name, an identification number, location data, an online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

That definition is wide. A contract that names a counterparty's employee, an invoice with a sole trader's bank details, or an email thread with phone numbers in the signatures all hold personal data. For a plain-language comparison with the US term, see what is PII.

Special category and criminal offence data

Some personal data carries more risk and needs extra conditions.

Special category data is listed in Article 9(1): racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, and data about a person's sex life or sexual orientation. Processing it needs a condition under Article 9(2), and in the UK the DPA 2018 Schedule 1 conditions also come into play. Our special category data page covers this in more detail.

Criminal offence data is covered by Article 10: personal data about criminal convictions and offences or related security measures. It may be processed only under official authority or where authorised by law. In the UK that authorisation comes from DPA 2018 sections 10 and 11 and the Schedule 1 conditions.

What changed with the Data (Use and Access) Act 2025

The DUAA received Royal Assent on 19 June 2025. Most of its data protection changes took effect on 5 February 2026. The government publishes a summary of the data protection changes and a commencement plan.

Subject access changes

Two DUAA changes affect subject access requests (SARs):

• Section 78 inserts Article 15(1A). The data subject is only entitled to what the controller can provide "based on a reasonable and proportionate search". This is treated as in force from 1 January 2024. (DUAA s.78)
• Section 76 inserts Article 12A, the "applicable time period". The one month runs from the latest of receipt of the request, receipt of ID information you asked for, or payment of a fee. The two-month extension is kept, and the clock stops while you reasonably need information to identify the data or processing the request concerns. This took effect on 5 February 2026. (DUAA s.76, SI 2026/82)

The ICO's right of access guidance explains how to count the month. For the practical side, see DSARs and document search and our DSAR glossary entry.

What DOCNUS checks under UK GDPR

The privacy assessment (Professional and Enterprise plans) reads each document for personal data, then applies a versioned UK GDPR and DPA 2018 rule pack. An AI model and deterministic pattern checks find the facts. Code decides the verdict, so the same findings always give the same result. We explain why in AI finds facts, code decides law.

Verdicts and the articles they cite

There are four verdict levels: not in scope, compliant / low risk, attention required, and non-compliant / high risk. Each comes with a risk score from 0 to 100 and the articles it relies on.

Obligations surfaced

Where relevant, the result also lists obligations to consider:

• Data protection impact assessment, Art. 35(3) (see what is a DPIA)
• Transparency, Art. 13 and 14
• Storage limitation, Art. 5(1)(e)
• International transfers, Chapter V
• The subject access deadline, Art. 12(3)

Whether the UK GDPR applies to a document is worked out from jurisdiction signals in it. Low-confidence matches are shown as "possible" and are not evaluated. If several laws apply, the document result shows the strictest verdict and which law drove it.

What this does not do

Be clear about the limits before you rely on it.

• It is an automated risk assessment. It is not legal advice, and every result says so.
• It does not assess your lawful basis decisions, your legitimate interests reasoning, or whether a recognised legitimate interest applies.
• It does not make you compliant. It shows where personal data sits in your documents and which rules are likely to matter.
• Detection is not perfect. You should review the findings and the cited pages.
• Assessment covers up to 100 pages per document. Longer documents are marked "partial".

In its findings DOCNUS stores masked values with a keyed fingerprint, never the raw value. Documents are processed by subprocessors in the US, as listed in our privacy policy. See our security page for how data is isolated and deleted.