At one water company, a stakeholder lead keeps two versions of their list: the working spreadsheet everyone edits, and a 'clean' copy saved before every board update in case the first gets overwritten. It isn't disorganisation. It's an attempt to keep a defensible record of personal data in a tool that was never built to hold it. In 2026, with the ICO's enforcement powers sharper and new complaint-handling duties live, that workaround is a liability.
A GDPR-compliant stakeholder database records personal data under a clear lawful basis, limits who can see and change it, tracks every consent and opt-out, keeps a date-stamped audit trail, and lets you find, export or delete any individual's data on request. The database itself must be secure, access-controlled and hosted somewhere you can account for.
This guide covers what that means in practice and what's changed for 2026.
What makes a stakeholder database GDPR-compliant?
Compliance isn't a feature you switch on. It's whether your database lets you satisfy the UK GDPR's core principles for the personal data you hold on stakeholders: names, emails, phone numbers, meeting notes, survey responses, and sometimes special category data like health or political opinion.
In practice, a compliant stakeholder database has to do six things:
-
Hold data under a documented lawful basis
-
Collect only what you need (data minimisation)
-
Keep it accurate and current
-
Retain it no longer than necessary
-
Secure it against loss or unauthorised access
-
Let you demonstrate all of the above, which is the accountability principle the ICO cares about most.
The Information Commissioner's Office sets out each principle in full.
The gap most engagement teams have isn't intent; it's evidence. They're processing lawfully but can't prove it quickly when asked.
Why spreadsheets put stakeholder data at risk
Spreadsheets fail on nearly every GDPR principle at once, which is why they're the most common source of stakeholder data risk.
They're uncontrolled by default. Anyone with the file can copy it, email it, or change a record without a traceable record, so there's no audit trail and no way to show who accessed what. Access can't be scoped to a project or a role, so data minimisation breaks the moment the file is shared. Retention is manual, so old contacts sit there indefinitely. A spreadsheet can often contain errors, which undermines the accuracy principle before anyone acts maliciously. A single spreadsheet emailed to the wrong recipient is a reportable personal data breach.
The point isn't that spreadsheets are careless. It's that they give you no way to prove care, and under GDPR, the burden of proof sits with you.
What's changed for GDPR in 2026?
The UK GDPR still applies, but the Data (Use and Access) Act 2025 amended it, and the main data-protection provisions came into force on 5 February 2026. Two changes matter most for stakeholder teams.
First, a statutory complaints duty is now in force. Since 19 June 2026, every organisation that processes personal data must have a formal process for handling data protection complaints, and must acknowledge a complaint within 30 days. There's no exemption for small teams or agencies. If a stakeholder objects to how you're using their data, you need a documented route to log, acknowledge and resolve it.
Second, the Act introduced 'recognised legitimate interests', a lawful basis for specific public-interest activities like responding to requests from bodies acting in the public interest, which don't require the usual balancing test. Public bodies running consultations should read this alongside their existing 'public task' basis. The full text sits on legislation.gov.uk, and the ICO has published updated guidance.
Practically, both duties are now live, so the bar has risen on two things a database can help with: proving your lawful basis and handling objections and complaints on the record.
What lawful basis applies to stakeholder engagement data?
Most stakeholder engagement runs on one of two lawful bases, and your database needs to record which one applies to each activity.
Public bodies, councils, NHS trusts and regulators usually rely on 'public task' for statutory consultation and engagement, because the processing is necessary to perform a function laid down in law, for example duties under the Planning Act 2008 or the Gunning Principles. Private organisations and consultancies more often rely on 'legitimate interests', which requires a documented balancing test weighing your interest against the individual's rights. Direct marketing to stakeholders, such as newsletters, is a separate question governed by PECR and usually needs consent.
The compliance risk isn't picking the wrong basis. It's not recording which basis you picked, so you can't answer the ICO or a stakeholder when they ask.
How should you handle consent, opt-ins and unsubscribes?
Where you rely on consent, GDPR expects it to be freely given, specific and recorded, and just as easy to withdraw as to give. Your database has to track the full history, not just the current state.
That means logging when someone opted in, to what, and through which channel, then automatically enforcing every unsubscribe so a stakeholder who opts out of one programme isn't accidentally contacted through another. Purpose-built engagement platforms do this at record level. Tractivity, the UK stakeholder relationship management (SRM) platform, tracks every opt-in and unsubscribe against the stakeholder and enforces communication restrictions automatically before any mailshot goes out, with fortnightly data cleansing flagging invalid addresses before mass communications are sent. A spreadsheet, by contrast, relies on someone remembering to check a column.
How do you respond to a subject access or erasure request?
Individuals can ask what data you hold on them (a subject access request), ask you to correct it, or ask you to delete it, and you generally have one calendar month to respond. Your database has to make that findable.
The test is simple: can you pull everything you hold on one named stakeholder, across every project and every interaction, in minutes rather than days? With engagement scattered across spreadsheets, inboxes and meeting notes, a single DSAR can take a week of manual searching, and you can never be certain you've found it all. A stakeholder database that holds every email, meeting, call, survey response and event attendance against the individual turns that into a filtered search and an export. That same completeness is what makes erasure reliable, because you can see and remove every trace, not just the copy you remembered.
How long should you keep stakeholder records?
GDPR's storage limitation principle says keep personal data no longer than necessary, but 'necessary' varies, and for engagement it's often longer than people assume.
A live consultation record may need to be retained for years to evidence a decision to a regulator, an inspector or a judicial review, which is a legitimate reason to keep it. Old marketing contacts who've had no relevant interaction are a different case and should be reviewed and cleared. The compliant approach is a documented retention schedule by data type, applied consistently, rather than either deleting evidence you're legally expected to hold or hoarding data you no longer need. A database that date-stamps every record and supports scheduled review makes that schedule enforceable instead of aspirational.
What security does a compliant stakeholder database need?
GDPR's security principle requires 'appropriate technical and organisational measures', and for public-sector engagement, that bar is high. This is where accreditation does the work of proof.
Look for encryption in transit and at rest, role-based permissions so people see only the projects and records they should, UK data residency you can point to, and independent testing you can evidence in a procurement response. Tractivity, for example, holds ISO 27001:2022, Cyber Essentials Plus, and the NHS Data Security and Protection Toolkit, hosts UK data by default in Microsoft Azure's UK South region, runs annual independent penetration testing by a CREST-approved organisation, and applies role-based permissions at project, module and record level. AI features run inside the same Azure environment, and customer data is never used to train models. Those accreditations exist precisely because a regulated buyer shouldn't have to take a security claim on trust.
This is also the difference a purpose-built platform makes over a repurposed CRM or a shared drive: the security model is designed for stakeholder data that a regulator may one day scrutinise.
A GDPR checklist for stakeholder databases in 2026
Use this to sense-check your current setup:
-
Every processing activity has a documented lawful basis (public task, legitimate interests, or consent).
-
You can produce a full record for any one stakeholder within the one-month DSAR window.
-
Consents, opt-ins and unsubscribes are logged and enforced automatically.
-
Access is role-based, so people see only what they need.
-
Data is encrypted, UK-hosted where required, and independently tested.
-
A retention schedule is documented and applied by data type.
-
A data protection complaints process is in place and can acknowledge within 30 days (required since 19 June 2026).
-
Every interaction is date-stamped and exportable, so you can evidence compliance on demand.
If you can tick these off from one system rather than stitching them together, you have an audit-ready record. If you're relying on spreadsheets and memory, you have exposure.
See it on your own data
Teams at EDF, National Grid, Anglian Water and the NHS Business Services Authority
moved off spreadsheets precisely because they needed engagement records that
hold up to scrutiny, including under GDPR. EDF logged around 30,000 stakeholder issues
at a 100% response rate across the Hinkley Point C and Sizewell C programmes, all
traceable to the individual. On average, teams using Tractivity report a 20% efficiency
gain in stakeholder management, worth £5,000 to £8,200 per professional a year, much
of it from not managing compliance by hand.
Ready to make your stakeholder record defensible?
If your stakeholder data still lives in spreadsheets, 2026 is the year to fix it. See how a purpose-built, UK-hosted stakeholder database keeps you compliant and audit-ready without the manual work.
Book a demo to walk through it on your own programme, or get in touch and we'll answer your compliance questions directly.
This guide is general information, not legal advice. For your organisation's obligations, check the ICO's guidance or take professional advice.
Frequently asked questions
