ICO enforcement action against UK organisations rose sharply in 2024 and 2025, with fines totalling over £12 million across the two years for failures in technical security measures. The pattern in ICO enforcement notices is consistent: organisations that suffered a breach and could not demonstrate that they had implemented appropriate technical controls faced the harshest outcomes. For developers, this is a direct professional concern. The decisions you make about encryption, logging, access control, and data retention are the technical controls that determine whether an organisation can defend itself before the ICO.
This guide is written for developers and engineering teams, not legal or compliance departments. It translates UK GDPR's requirements into concrete technical decisions: what to implement, how to implement it, and why each measure exists.
TL;DR
UK GDPR Article 32 requires "appropriate technical measures" proportionate to the risk. For most applications handling personal data this means encryption at rest and in transit, pseudonymisation where feasible, access controls, and documented breach detection capability.
The most common developer mistakes that create GDPR exposure: logging PII in debug output, soft-deleting records that should be hard-deleted for right to erasure, and failing to implement DPAs with every third-party service that touches personal data.
