FileMaker Security & UK GDPR - 2026 Buyer's Checklist

This guide is for teams buying, inheriting or auditing a Claris FileMaker system that handles personal data in the UK. It is not legal advice - for that you need a qualified DPO or solicitor - but it is the checklist we use every time we onboard a new client or complete a FileMaker Health Check. If an inherited system fails on more than two or three of these, it needs remediation before it keeps carrying your data.

The UK GDPR basics that matter for FileMaker

UK GDPR (the Data Protection Act 2018, retained post-Brexit) sets out six data-protection principles. Translated into FileMaker engineering terms, they become:

• Lawfulness / fairness / transparency: every record has a documented lawful basis; the system can explain what it stores and why.
• Purpose limitation: fields and tables are scoped to the purpose you told the subject about.
• Data minimisation: no legacy columns holding data you no longer need - a surprisingly common finding.
• Accuracy: subjects can correct their data; the system supports amendment and versioning.
• Storage limitation: automated retention and deletion, not manual cleanup.
• Integrity & confidentiality: encryption at rest, encryption in transit, access control, audit logs.

The 14-point FileMaker security checklist

Self-host vs FileMaker Cloud - for UK buyers

The biggest architectural choice is where the server runs. As of 2026 there is no UK-native Claris FileMaker Cloud region - the EU region is Dublin (Ireland). For most commercial workloads that is fine; for public sector, healthcare, legal and defence-adjacent clients it usually is not.

The audit-log gap - and how to close it

Claris FileMaker does not ship a production-grade field-level audit log. The server logs authentication, and script-level triggers exist, but neither gives you a "who changed field X from A to B, when, from which client" record that regulators expect. The usual fix is a shadow audit framework: a single Audit table, populated via OnRecordCommit script triggers, with immutable rows keyed to the edited record, the editing account, a timestamp and the before/after values. Done right, it adds under 5% overhead and gives you defensible evidence in an ICO investigation.

DSAR tooling - the 30-day clock

UK GDPR gives you 30 calendar days to respond to a Data Subject Access Request (extendable to three months if complex). If your FileMaker system has personal data scattered across half a dozen tables with no central Subject key, that clock will beat you. What good looks like:

1. A central Subject (or Contact) primary key every PII-bearing record points to.
2. A "Export Subject" script that collates every field from every table for a given subject into a single PDF / JSON bundle.
3. A "Redact Subject" script that either anonymises (safer) or deletes (sharper) with an audit trail of what was done.
4. A DSAR log - which subject, which request type, who actioned, when, outcome.

We typically build this as a 2–4 day engagement on an existing system, often alongside a FileMaker Health Check.

Common red flags in inherited systems

• Every user logs in as "Admin" with Full Access privileges (no personal accountability).
• Encryption at rest disabled because "it slows backups down".
• A single shared password in a README or onboarding doc.
• Backups on the same physical server as the live database.
• No retention policy - customer records from 2012 still sitting in production.
• Hosting provider gives you no DPA and can't tell you which data centre your data is in.
• Leavers are still enabled weeks after HR-announced departures.
• No field-level audit - you can see a record was changed, but not what was changed or by whom.

What good looks like in 2026

A 2026-grade FileMaker deployment looks roughly like this: UK-hosted FileMaker Server on encrypted disks, EAR on all hosted files, SSO via Azure AD / Okta / Google Workspace with MFA, role-based privilege sets with no end-user Full Access, a shadow audit framework on regulated fields, hourly encrypted backups to geo-separate UK storage, quarterly restore drills, a documented ROPA entry, a signed DPA with the hosting partner, and a DSAR toolkit that has actually been used at least once in anger.

This is the Neptune Digital managed hosting baseline. If you are assessing a different partner, ask them to evidence each of the 14 controls in the table above - not "yes we do that", but a screenshot, log export, or policy document per control. Good partners will have them ready.

See also - Best FileMaker Developers in the UK (2026), UK FileMaker cost guide, and Neptune Digital managed FileMaker hosting.