A 30-day starter plan

Four weeks, four jobs

Thirty days will not finish the job, but it puts the basics in place. Take one theme a week, and give each a named owner.

This plan is practical advice, not a legal standard, and finishing it does not by itself mean you meet the Act. The order matters: you cannot write an itemised notice (Rule 3), secure your systems (Rule 6) or answer a request (s.11) until you know what data you hold. Weeks 2 and 3 are covered in Chapters 2 and 3; this chapter fills in weeks 1 and 4.

Week 1: one spreadsheet, four columns

Start with a data map. One spreadsheet that lists what you hold, why, where it sits and how long you keep it will drive every other step.

The Act does not ask for a data map by name. You need one in practice to state a lawful ground for each purpose (s.4), itemise data in your notice (Rule 3(b)), tell a person which processors received their data (s.11(1)(b)), set deletion dates (s.8(7)) and work out who is affected in a breach (Rule 7). Include the tools people forget: WhatsApp chats, spreadsheets, payment gateway dashboards, analytics and old backups.

Week 4: be reachable

Only Significant Data Fiduciaries must appoint a Data Protection Officer. You still need a named contact, and a grievance process that responds within ninety days.

The Data Protection Officer duty sits in s.10(2)(a), which applies to Significant Data Fiduciaries. Rule 9 requires every fiduciary to publish prominently the business contact information of a person who can answer questions, and to mention it in every response to a rights request. Rule 14(1) requires you to publish the means for making requests and any identifier you need, such as a mobile number. Rule 14(3), read with s.13(2), requires a published grievance response period of not more than ninety days. Under s.13(3) a person must use your grievance process before approaching the Board, so it is your first chance to resolve a complaint.

Handling a rights request

People who gave you their data can ask for a summary of it and who you shared it with. They can also ask you to correct, complete, update or erase it.

Section 11(1) gives a right to a summary of the data and processing activities, and the identities of the fiduciaries and processors it was shared with. Section 12(2) requires you to correct, complete and update on request, and s.12(3) requires erasure unless retention is necessary for the specified purpose or to comply with a law. These rights belong to people who gave consent, including under s.7(a). The Act and Rules set no separate deadline for these requests; the ninety-day limit in Rule 14(3) is for grievances, so aim to answer well inside it. A person may also nominate someone to exercise these rights (s.14, Rule 14(4)).

Keep evidence as you go

If consent is questioned in a proceeding, you must prove that you gave notice and obtained consent. A dated log from your sign-up form is a good place to start.

Section 6(10) puts the burden on the Data Fiduciary to prove that notice was given and consent obtained in line with the Act and Rules. The law does not prescribe a format for these records. The other items on this list are not required by s.6(10), but they help you show what you did: the 72-hour breach report must include a report on the intimations given to people (Rule 7(2)(b)(vi)), and mitigation is a penalty factor (s.33(2)(e)).

Your 30-day plan

Here is the whole plan on one screen. Steps one and two are week one, three to five are week two, six and seven are week three, and the rest are week four.

References for each step: 1 and 2, s.4 and s.7; 3, s.6(1); 4, s.5 and Rule 3; 5, s.6(1) and s.6(4); 6, s.8(5) and Rule 6; 7, s.8(2), Rule 6(1)(f), s.8(7) and Rule 8(3); 8, Rule 9 and Rule 14; 9, s.6(10) and s.11 to s.13; 10, s.8(6) and Rule 7. If children or teenagers use your service, add the s.9 steps from Chapter 2 to week two. Review the plan whenever you add a new tool or a new use of data.

If the Board gets involved

A penalty needs an inquiry, a hearing and a finding that the breach is significant. The Board must consider how quickly you acted, and it can accept a voluntary undertaking to fix the problem.

Section 33(1) allows a penalty only where the Board finds a significant breach after an inquiry and a hearing. Section 33(2) lists what it must have regard to: nature, gravity and duration; type of data; repetition; gain or avoided loss; mitigation and its timeliness; proportionality; and the likely impact on the person. The Schedule has no separate scale for small businesses. Under s.32 the Board may accept a voluntary undertaking at any stage of a proceeding, which bars proceedings on its contents; breaking it is treated as a breach of the Act. Orders can be appealed to the Appellate Tribunal within sixty days (s.29).

When to get a lawyer

You can do much of the groundwork yourself. Pay for advice where a mistake is costly: children's data, health or financial records, a live breach, or any letter from the Board.

This track is a simplified guide, current as of November 2026, and not legal advice. The Act works in addition to other laws (s.38), so sector rules for clinics, lenders or schools may add to it. The Government may restrict transfers of personal data to notified countries (s.16) and set conditions under Rule 15, so check the position before moving data abroad. Read the official Act and Rules, and check for new notifications before you rely on any date or exemption.

In one line

That is the starter plan. Use it to begin, then check the official text and take advice for your own situation.