GDPR Compliance Statistics UK: How Prepared Are Businesses in 2026?

How GDPR-ready are UK businesses in 2026? The headline data-protection compliance and training statistics in one place — awareness of the ICO, how many firms actually train staff, the widening small-business gap and what the new Data (Use and Access) Act 2025 changes — with the data period stated next to every figure.

The UK Business Data Survey 2026, published on 18 June 2026, and the Cyber Security Breaches Survey 2025/26, published on 30 April 2026, measure reported practices and awareness. They provide useful preparedness indicators, but neither is an audit that certifies whether every surveyed business complies with UK GDPR.

This page covers awareness, governance and training. Survey populations differ between questions, so each figure should be read with its denominator. The absence of a particular recent activity does not by itself establish a legal breach.

Key facts and figures

• 62% of UK businesses handling digitised data have heard of the ICO and know what it does; 21% have never heard of it at all (UKBDS 2026).
• 11% of businesses with employees that handled digitised personal data reported training existing staff in the previous 12 months, down from 23% in the 2023/24 survey (UKBDS 2026).
• 10% of eligible micro businesses reported data-protection training for existing staff, compared with 49% of eligible large businesses (UKBDS 2026).
• 56% of businesses with employees handling digitised personal data reported someone whose role included leading on compliance — 53% of micro firms and 92% of large firms (UKBDS 2026).
• 46% of businesses handling digitised personal data agreed that ICO guidance was clear and easy to understand; 34% were neutral and 9% disagreed (UKBDS 2026).
• 19% of businesses carried out any staff cyber-security training or awareness activity in 2025/26 — unchanged year on year (CSBS 2025/26).
• 31% of businesses have board-level responsibility explicitly assigned for cyber security and data protection, up from 27% (CSBS 2025/26).
• 19 June 2026 — all DUAA data protection and PECR provisions were in force by this date; most substantive reforms commenced on 5 February 2026.

The headline preparedness measures at a glance:

The figures were checked on 15 October 2026. UKBDS fieldwork ran from October 2025 to January 2026 and asked about activities in the preceding 12 months. This predates the main February and June 2026 DUAA commencements, so the survey does not measure compliance with the fully implemented reforms.

What percentage of UK businesses have trained staff on data protection?

In UKBDS 2026, 11% of businesses with employees that handled digitised personal data reported training existing staff in the previous 12 months, compared with 23% in the preceding 2023/24 survey. The relevant question’s base was 3,150 businesses, within the full 4,450-business survey. The figure is not a rate for every UK business or a count of staff who have ever received training.

The separate Cyber Security Breaches Survey 2025/26 found that 19% of businesses carried out staff cyber training or awareness activity in the previous 12 months, unchanged from the previous wave. This broader cyber measure should not be treated as interchangeable with the UKBDS data-protection question.

Training can help staff recognise requests and handle information securely, but these surveys do not identify the cause of most compliance failures. Effective controls also include appropriate access, retention, technology and procedures. Our human error and breach statistics guides distinguish those different measures.

How aware are UK businesses of the ICO and GDPR requirements?

Among UKBDS respondents handling digitised data, 62% had heard of the ICO and knew what it was, 17% had heard of it but did not know what it was, and 21% had not heard of it. This is self-reported regulator awareness, not a test of knowledge of every GDPR requirement.

Within businesses handling digitised data, 73% of large businesses knew what the ICO was, compared with 56% of micro businesses. Finance and insurance reported 94%. The survey identifies differences in awareness; it does not establish their causes or measure actual compliance by sector.

Among businesses handling digitised personal data, 46% agreed that ICO guidance was clear and easy to understand, 34% neither agreed nor disagreed and 9% disagreed. Neutral or unrecorded opinions should not be reclassified as difficulty understanding the guidance.

Are small businesses less GDPR-compliant than large ones?

The surveys show differences in reported activities, not a direct ranking of legal compliance. For example, 10% of eligible micro businesses reported training existing staff compared with 49% of large businesses. Different size, staffing and processing needs affect what arrangements are appropriate.

Accountability follows the same pattern. Across firms that employ staff and handle personal data, 56% have someone whose role includes leading on data-protection compliance — but that falls to 53% among micro businesses and rises to 92% among large ones. The Cyber Security Breaches Survey shows an even wider training divide on the cyber side: 84% of large businesses ran staff cyber-security training or awareness activity in 2025/26, against just 19% of businesses overall.

Smaller organisations can still have substantial data protection responsibilities. Duties depend on the processing and circumstances: not every business needs a dedicated data protection officer, and some documentation exceptions are activity-specific. A survey measure of a named lead should not be treated as a legal requirement for every firm.

Who leads on data-protection compliance in UK firms?

UKBDS reports that 56% of businesses with employees handling digitised personal data had someone whose role included leading on compliance, with 53% among micro firms and 92% among large firms. This need not be a dedicated or legally designated data protection officer.

Among businesses with employees handling digitised personal data, 29% reported employing or outsourcing specialist staff to handle data protection requirements. A separate staffing measure found that 44% had no full-time-equivalent staff whose primary role was data protection compliance. That does not mean nobody undertook compliance work.

Among businesses handling digitised personal data, 76% said the perceived compliance burden had stayed the same over the previous 12 months, 19% said it had increased and 1% said it had decreased. These are respondents’ perceptions, not measured compliance costs or a finding of inadequate governance.

What is the Data (Use and Access) Act 2025 and does it change GDPR training needs?

Most substantive data protection reforms in Part 5 of the DUAA commenced on 5 February 2026, with the controller complaints duty following on 19 June 2026. The Act amends UK GDPR, the Data Protection Act 2018 and PECR. Organisations should review relevant processes and information as the law changes.

The changes cover recognised legitimate interest as a lawful basis, automated decisions, subject access and complaints, among other matters. The appropriate response depends on an organisation’s processing; a change to the law does not by itself establish that every previous training programme or procedure is inadequate.

Preparedness surveys cannot certify compliance. Organisations need to assess their own processing, applicable duties and evidence of how those duties are met. Enforcement statistics provide a separate view of the cases the regulator has pursued, rather than a compliance rate for the business population.

Frequently asked questions

What percentage of UK businesses have trained staff on data protection?

UKBDS 2026 reports 11% among businesses with employees handling digitised personal data, compared with 23% in the previous survey. The question concerned training existing staff in the preceding 12 months. The separate CSBS measure was 19% of businesses reporting cyber training or awareness activity.

How aware are UK businesses of the ICO and GDPR requirements?

62% of businesses handling digitised data know what the ICO is and what it does; 17% have heard of it but do not know what it does, and 21% have never heard of it (UKBDS 2026). Awareness rises with size — 73% of large firms against 56% of micro firms — and peaks at 94% in finance and insurance.

Are small businesses less GDPR-compliant than large ones?

These surveys do not establish a legal compliance ranking. They report, for example, data-protection training at 10% of eligible micro businesses and 49% of large firms, and a compliance lead at 53% and 92%. Appropriate arrangements depend on the processing and the organisation’s circumstances.

What is the Data (Use and Access) Act 2025 and does it change GDPR training needs?

The DUAA amends UK GDPR, the Data Protection Act 2018 and PECR. Most substantive reforms commenced on 5 February 2026 and the controller complaints duty on 19 June 2026. Organisations should review the changes relevant to their activities and update procedures and staff information where necessary.

How common are dedicated data-protection roles?

UKBDS reports that 56% of businesses with employees handling digitised personal data had someone whose role included leading on compliance. Separately, 44% had no full-time-equivalent staff whose primary role was compliance. A shared responsibility or part-time role is not the same as having nobody responsible.

Is the compliance burden on UK businesses increasing?

Among UKBDS businesses handling digitised personal data, 76% said the perceived burden stayed the same, 19% said it increased and 1% said it decreased. In the separate CSBS survey, 31% of businesses assigned board-level responsibility for cyber security and data protection, up from 27%.

Related guides

• Data Breach Statistics UK: ICO Reports, Trends & Costs
• Human Error Data Breach Statistics: What the ICO Data Shows
• ICO Complaints Statistics UK: Volumes, Outcomes & Trends
• AI and Data Privacy Statistics UK: Adoption, Risk & Rules
• Who does GDPR apply to? Scope and enforcement in the UK
• UK GDPR vs EU GDPR: what actually differs after the DUAA

Sources & references

• DSIT — UK Business Data Survey 2026, sections 6 and 9
• DSIT and Home Office — Cyber Security Breaches Survey 2025/26
• ICO — Data (Use and Access) Act 2025 changes and commencement
• ICO — accountability and governance guidance

Mark McShane

Health & Safety Training Specialist, Online CPD Academy

Mark writes about data protection, GDPR compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.