Who this is for

• UK companies that need their data protection, marketing and product-security documentation on the current footing rather than the pre-DUAA one.
• Companies operating in both the UK and EU who’ve realised their single compliance file can’t be right in both markets.
• Non-UK companies that offer goods or services to UK individuals and need a UK representative.
• Manufacturers of connectable consumer products selling into the UK.
• Fractional DPOs and advisers who want a defensible, post-DUAA starting point rather than a blank page.

What you get:

Seven documents, each an explanatory notice (what the obligation is and why the document is shaped as it is) paired with a ready-to-complete template:

• UK–EU Divergence Map — where the UK and EU positions differ, and which document governs which market. Start here; it’s the document that prevents the single most common mistake. Free to download — see below.
• UK GDPR Records of Processing — Article 30 records on the post-DUAA footing, reflecting recognised legitimate interests and the new automated decision-making regime.
• DPIA — the Article 35 impact assessment, updated for the DUAA, including the Article 22A–22D automated decision-making safeguards.
• ICO Accountability Documentation — the accountability record plus the new section 164A complaints procedure (electronic form, 30-day acknowledgement) that became mandatory in June 2026.
• PECR Compliance Record — electronic marketing and cookies under PECR as amended by the DUAA, including the new consent exemption for certain analytics and functionality cookies.
• UK Representative Appointment — the Article 27 appointment where your organisation is established outside the UK.
• PSTI Statement of Compliance — the three security requirements and statement of compliance for consumer connectable products.

Each is a draft for legal review, structured so a lawyer approves it fast and the ICO or OPSS can follow it.

Why one EU file doesn’t cover both markets

The divergence is specific, and it lands exactly where documentation lives:

• DUAA introduced a recognised legitimate interests basis that needs no balancing test, so your UK lawful-basis analysis now says something your EU one doesn’t.
• DUAA replaced the old automated decision-making prohibition with a permission-plus-safeguards model, so your DPIA asks different questions.
• DUAA exempted certain analytics and functionality cookies from prior consent, so your UK cookie banner and your EU one should no longer be identical.
• PSTI is a wholly separate regime from the EU’s Cyber Resilience Act, enforced by a different authority on a different timetable. A single document blurs all of this; the pack keeps it straight.

Built to the law as it stands now

UK data protection law is moving, and this pack reflects it as of its edition date: the DUAA’s main provisions in force since February 2026, the complaints duty since June 2026, PSTI since April 2024.

Every template carries a “law checked on” field, and the pack includes twelve months of updates as further provisions commence and ICO guidance on the newest changes lands.

Start with the free UK divergence map

Download the UK–EU Divergence Map at no cost. Work through it and you will know where your UK and EU positions have come apart, which document governs which market, and which of the seven documents in the pack you actually need — before you spend anything.

Download the free divergence map

What the price covers

£300 includes twelve months of updates as the DUAA continues to commence and ICO guidance develops.

A firm drafting this set from scratch — records, DPIA, accountability, PECR, PSTI, and advising on the UK–EU divergence — will typically run £6,000–15,000. The pack is the same structure at a fraction of the cost, with the reasoning included so you understand what you’re signing and can brief your lawyer efficiently.

What this pack is not (Important)

This is not legal advice, and it’s not filing-ready out of the box. It’s professionally structured documentation that a qualified lawyer should review against your circumstances before you rely on it. Because the DUAA is recent and its guidance is still emerging, the pack takes positions on developing questions — the scope of recognised legitimate interests, the automated decision-making safeguards, and which cookies fall within the new consent exemption — that warrant review as the position matures.