Compliance

Annual Penetration Testing Requirements Under UK GDPR

> framework: UK_GDPR —— article: 32 —— requirement: appropriate_technical_measures —— includes: security_testing<span class="cursor-blink">_</span>_

Hedgehog Security 10 September 2024 11 min read

What the law actually requires.

There is a persistent question among business owners: does UK GDPR actually require penetration testing? The answer is nuanced. UK GDPR does not use the words 'penetration test' anywhere in the legislation. However, Article 32 requires 'appropriate technical and organisational measures' to ensure the security of personal data, and Article 32(1)(d) specifically requires 'a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing'.

The Information Commissioner's Office (ICO) — the UK's data protection regulator — interprets this requirement to include security testing. In multiple enforcement actions, the ICO has cited the absence of penetration testing as evidence of inadequate security measures. While the GDPR does not mandate a specific test type or frequency, the regulatory expectation is clear: if you process personal data, you should be testing the security of the systems that handle it.


Recommended

Free: Cyber Essentials Pre-Audit Checklist

Prepare for your Cyber Essentials certification with our practical checklist covering all five technical controls.

What each regulation specifically requires.

Framework Testing Requirement Frequency
UK GDPR (Article 32) Requires 'a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.' The ICO expects this to include penetration testing as part of a broader security testing programme. Enforcement actions have specifically cited the absence of penetration testing. Regularly — no specific frequency mandated. Annual testing is the widely accepted minimum standard. The ICO considers the risk profile of the data processed when evaluating adequacy.
PCI DSS (Requirement 11.4) Explicitly mandates penetration testing for any organisation that stores, processes, or transmits cardholder data. Requires both external and internal testing. Tests must be performed by a qualified internal resource or qualified external third party. At least annually, and after any significant infrastructure or application change. Segmentation controls must be tested every six months.
ISO 27001 (Annex A.18.2.3) Requires 'technical compliance review' of information systems — verification that security controls are correctly implemented and effective. Penetration testing is the primary method of demonstrating this. Aligned with the organisation's risk assessment cycle. Typically annually, or more frequently for high-risk systems.
Cyber Essentials Plus Includes a verified technical assessment conducted by a certified assessor — covering external vulnerability scanning and internal security review. While not a full penetration test, it verifies that Cyber Essentials controls are correctly implemented. Annually for certification renewal.
FCA (Operational Resilience) The Financial Conduct Authority expects regulated firms to conduct regular penetration testing as part of their operational resilience obligations. Larger firms may be subject to CBEST or TIBER-EU threat-intelligence-led testing requirements. At least annually for general testing. CBEST and TIBER-EU cycles as determined by the regulator.
NHS DSPT The Data Security and Protection Toolkit requires NHS organisations and their suppliers to demonstrate appropriate security testing. Penetration testing evidence is an expected component of submissions. Annually, aligned with the DSPT submission cycle.
NIS2 Directive The Network and Information Systems Directive 2 requires 'appropriate and proportionate technical, operational and organisational measures to manage risks to the security of network and information systems.' Penetration testing is a recognised component of demonstrating compliance. Regular testing aligned with the organisation's risk management framework.

What happens when organisations do not test.

The ICO has issued enforcement actions against multiple organisations where the absence of security testing — including penetration testing — was cited as a contributing factor in a data breach. While the ICO does not publish a comprehensive list of what constitutes 'appropriate' security measures, their enforcement notices and monetary penalty notices provide clear signals about expectations.

Fines Reference Inadequate Testing
In multiple enforcement actions, the ICO has noted that the organisation had not conducted penetration testing — or had not tested recently enough — and that testing would have identified the vulnerability that led to the breach. The absence of testing is treated as evidence that security measures were not 'appropriate'.
Proportionality Is Key
The ICO applies the principle of proportionality — the security measures expected depend on the volume and sensitivity of data processed, the risks involved, and the cost of implementation. For most organisations processing personal data, annual penetration testing is considered proportionate and cost-effective.
Testing Demonstrates Due Diligence
If a breach occurs despite a recent penetration test and subsequent remediation, this demonstrates that the organisation took reasonable steps to identify and address vulnerabilities. A current penetration test report is one of the strongest pieces of evidence you can present in response to an ICO investigation.

How to build testing into your compliance programme.

Meeting penetration testing requirements does not need to be complicated. A straightforward annual testing programme, combined with remediation tracking and retesting, satisfies the expectations of all major UK compliance frameworks.

Compliance-Aligned Testing Programme
── Annual Cycle ────────────────────────────────────────────
Commission annual penetration test (external + web app)
Schedule 4–6 weeks before compliance deadline
Allow time for remediation and retest

── Documentation ───────────────────────────────────────────
Retain penetration test reports for at least 3 years
Maintain remediation tracker with evidence of fixes
Document risk acceptance decisions for unresolved findings
Keep retest results alongside original findings

── Evidence for Auditors / Regulators ─────────────────────
Current penetration test report (within 12 months)
Remediation tracker showing findings resolved
Retest report confirming critical/high fixes verified
Risk acceptance register for unresolved findings
Year-over-year comparison showing improvement trend

What auditors and regulators look for.

When your penetration test report is submitted as compliance evidence, auditors and regulators evaluate both the report itself and the credentials of the provider who delivered it. Using a CREST-accredited provider with individually certified testers significantly strengthens your compliance position — the accreditation provides independent assurance of the test quality.

A test report from an unaccredited provider may be accepted but is more likely to face scrutiny. A test report from a CREST-accredited provider is accepted by default by most auditors, the ICO, the FCA, and PCI QSAs. The accreditation does the credibility work for you.


Reports that satisfy your regulators and auditors.

Our penetration test reports are designed for compliance submission. CREST-accredited testing, individually certified testers, comprehensive reporting, and full remediation support — everything your auditor expects to see.

Next Step

Free: Cyber Essentials Pre-Audit Checklist

Prepare for your Cyber Essentials certification with our practical checklist covering all five technical controls.


Related Articles