Data protection

You can’t process personal data without a valid lawful basis. The UK GDPR sets out six options:

• Consent – Necessary for performance of a contract.
• Compliance with the law.
• Protection of someone’s life.
• Performing a task in the public interest.
• Legitimate interests of the organisation or third parties

Sensitive data, such as racial or ethnic origin, political or religious opinions and health data gets greater protection. You can only process this type of information if you meet one of several specific conditions.

Tip: The UK’s privacy regulator, the Information Commissioner’s Office (ICO), has published a handy guide to lawful basis to help you choose the right option.

UK GDPR sets out seven core data protection principles. These aren’t just a box-ticking exercise – they are the foundation of good data protection practice:

• Lawfulness, fairness and transparency.
• Purpose limitation.
• Data minimisation.
• Accuracy.
• Storage limitation.
• Integrity and confidentiality (security).
• Accountability.

Failure to comply with the legislation can lead to substantial fines of up to £17.5 million or 4% of an organisation’s total worldwide annual turnover, whichever is higher. More information is available on the ICO’s website: Data protection principles - guidance and resources.

Both controllers (those deciding how and why data is used) and processors (those acting on a controller’s instructions) have responsibilities. Controllers must have binding contracts in place with processors, and those contracts have compulsory provisions as set out in UK GDPR.

If you’re unsure what your role is, the ICO has clear guidance for both controllers and processors.

See: What does it mean if you are a controller? | ICO and What does it mean if you are a processor? | ICO.

Under UK GDPR, individuals have various rights relating to their personal data, such as:

• The right to be informed about how their data is being used.
• The right to access their personal data.
• The right to request data processing restrictions.

You need to make sure these rights are exercised effectively. The ICO’s guide to individual rights offers practical guidance.

Since personal data transferred out of the UK may lose the protection of UK legislation, UK GDPR has rules about international transfers. These include:

• Making sure transfers are covered by UK ‘adequacy regulations’ (where the recipient country or territory provides ‘adequate protection’.
• Using appropriate safeguards, such as binding corporate rules or standard data protection clauses.
• Applying for one of the eight exceptions listed in the UK GDPR (including whether the transfer is necessary for the performance of a contract).

The EU GDPR adequacy decision allows personal data to be transferred from the EU into the UK. This EU decision is set to expire in December 2025 (following an extension from June 2025), to allow for consideration of the changes made by the newly enacted DUA Act.