What is GDPR-compliant business?

A GDPR-compliant business handles personal data according to the UK GDPR and Data Protection Act 2018. Core requirements include a lawful basis for processing, a clear privacy notice, data-subject rights handling (access, erasure, rectification) within one month, breach notification within 72 hours, and — where applicable — appointing a Data Protection Officer. Compliance is regulator-assessed by the ICO, with fines up to £17.5m or 4% of global turnover.