GDPR and Website Security: What UK Businesses Are Legally Required to Do

GDPR and website security: what UK businesses are legally required to do

UK GDPR does not tell you which security tools to buy. What it does is hold you legally responsible for the outcome if your website is breached and customer data is exposed — regardless of whether you knew about the vulnerability.

Article 32 requires data controllers to implement appropriate technical and organisational measures to ensure security appropriate to the risk.

What counts as personal data on a website

Names, email addresses, phone numbers, IP addresses, browsing behaviour, purchase history, health information — any information that can identify an individual. This covers almost every business website with a contact form, account system, checkout, or newsletter signup.

What appropriate technical measures means

The ICO expects encryption of personal data, access controls, regular testing of security measures, and the ability to detect and respond to breaches.

Regular testing is where most small businesses fall short. Implementing HTTPS is not sufficient. Appropriate security means actively verifying your systems are not vulnerable.

The fines for getting it wrong

Up to £17.5 million or 4% of global annual turnover. In 2023 a dental practice was fined £50,000 after patient records were accessed through an unsecured database. In 2024 a law firm received £60,000 following a ransomware attack the ICO determined could have been prevented with basic security testing.

Does GDPR require penetration testing specifically?

Not by name. But Article 32(1)(d) requires regular testing, assessing, and evaluating the effectiveness of technical measures. Penetration testing is the recognised industry standard for fulfilling this obligation.

Yrzo AI runs 75+ automated security checks and produces a report documenting what was tested, found, and fixed — evidence of due diligence. Starting at £149.