Stratgik — technology strategy and business systems engineering.
Delivery across the USA, UK, UAE and India.
UK GDPRData (Use and Access) Act in force from 5 February 2026
The Data (Use and Access) Act 2025 changed how UK organisations handle legitimate interests, cookies, subject access requests, automated decisions and complaints. We map your data, update notices and processes, and build the changes into your website, CRM and products, for a fixed fee.
What is at stake
The Information Commissioner’s Office sets the amount based on seriousness, duration, harm and what you did to put it right. These are statutory maximums.
Breaches of the core principles, lawful basis, individuals’ rights or international transfer rules
Failures in obligations such as records, security measures or breach notification
Electronic marketing and cookie breaches under PECR, now aligned with UK GDPR maximums
What the law asks, in plain words
Tell people what you collect, why, the lawful basis, who receives it and how long you keep it, in clear language.
The 2025 Act lists recognised legitimate interests such as security and fraud prevention that no longer need a balancing test. Everything else still needs a documented basis.
Some analytics and functionality cookies can now rely on an opt-out. Advertising and tracking cookies still need prior consent.
Respond within one month. Searches must be reasonable and proportionate, and the clock can pause while you wait for information you genuinely need.
Report notifiable personal data breaches to the ICO within 72 hours of becoming aware, and tell affected people when the risk is high.
Give people a way to complain about how their data is handled, acknowledge complaints within 30 days and respond without undue delay.
Significant automated decisions need safeguards: information about the decision, a way to contest it and access to human review.
Contracts with every processor, and an International Data Transfer Agreement or Addendum where data leaves the UK.
Free self-check
Ten questions, two minutes. Nothing is sent anywhere unless you ask for help.
How we get you compliant
Discover
Website, apps, CRM, ERP, spreadsheets, messaging tools and vendors.
Decide
Each gap scored against enforcement exposure and effort, so the serious ones get fixed first.
Implement
Notices, consent, request workflows, access controls, retention and vendor terms.
Hand over
A live session for the staff who handle data and a practice run of breach reporting.
Pricing
For organisations with one website or product and up to five systems holding personal data. Larger scope is quoted in writing before you pay anything.
Know where you stand against UK GDPR and the 2025 Act.
£1,450one-time
+ VAT
Report in 7 working days
Choose Readiness AuditRecommended
We implement the changes in your systems.
£4,900one-time
+ VAT
Typically 3 to 5 weeks
Choose Compliance SetupStay compliant as systems, vendors and guidance change.
£690per month
+ VAT
Cancel any month
Choose Data Protection CareA clear line: Stratgik is a technology firm, not a law firm. We implement and operate compliance in your systems. Where you need a legal opinion, we work alongside your lawyer.
Free readiness call
An engineer replies within one working day with a suggested approach and a fixed quote.
Yes, if you offer goods or services to people in the UK or monitor their behaviour. Organisations without a UK establishment may also need a UK representative.
Among other things: recognised legitimate interests, relaxed consent for some low-risk cookies, clearer rules for subject access searches, reformed automated decision-making rules, a duty to handle data protection complaints, and PECR fines raised to UK GDPR levels.
Mostly, but UK and EU rules are now diverging. UK-specific changes to cookies, legitimate interests, complaints handling and international transfers need their own review.
Only public authorities and organisations whose core activities involve large-scale monitoring or special category data must appoint one. Everyone else still needs someone accountable for data protection.
No. Stratgik is a technology firm. We implement notices, workflows, consent, logging and security in your systems, and work alongside your solicitor where a legal opinion is needed.
Yes, for organisations with one website or product and up to five systems holding personal data. Larger scope is quoted in writing before any work starts. VAT is added where applicable.
A readiness audit takes 7 working days and gives you a ranked, costed plan.
The Stratgik model
Four stages, in order. Most businesses need them one at a time.
