UK GDPR (2021)

Process personal data lawfully, fairly, and in a way that is transparent to the people it concerns. Every processing activity needs an identifiable legal basis (see Art. 6) and must not mislead or surprise the person it's about.

Collect personal data only for specified, explicit, legitimate purposes, and don't process it further for a new purpose that's incompatible with the original one. If you want to reuse data for something new, check compatibility first or get a fresh legal basis.

Collect and retain only the personal data that is adequate, relevant, and necessary for the purpose at hand. Don't gather 'nice to have' data on the chance it becomes useful later.

Keep personal data accurate and up to date, and take reasonable steps to correct or erase inaccurate data without delay. Give people a working way to flag inaccuracies.

Keep personal data in identifiable form only for as long as necessary for the purpose it was collected for. Define retention periods and actually enforce deletion or anonymisation when they expire.

Process personal data with appropriate security against unauthorised or unlawful processing, accidental loss, destruction, or damage. This principle is made concrete by the security-of-processing duty in Art. 32.

Every processing activity must rest on one of the lawful bases: consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests. Identify and record which basis applies to each processing activity before you start. Since 5 February 2026, the DUAA adds recognised legitimate interests: processing for a purpose listed in UK GDPR Annex 1 (e.g. safeguarding, crime prevention and public-body disclosures, responding to a public-interest request from a public authority) counts as a legitimate interest without needing the separate balancing-test assessment Art. 6(1)(f) otherwise requires — the basis still has to fit one of the listed purposes.

When you collect personal data — whether directly from the person (Art. 13) or from another source (Art. 14) — tell them who you are, why you're processing their data, on what legal basis, how long you'll keep it, who it goes to, and what rights they have. Deliver this before or at the point of collection (Art. 13), or within a reasonable time when collected elsewhere (Art. 14).

When consent is your lawful basis, it must be freely given, specific, informed, and unambiguous, requested in clear plain language separate from other matters, and as easy to withdraw as to give. Consent for an information-society service offered directly to a child needs parental authorisation below the age of 13 — the fixed UK threshold set by DPA 2018 s.9, rather than the EU's member-state-variable 13-16 range. Decide this in only if consent is a lawful basis you actually rely on.

Provide privacy information and respond to data-subject-rights requests in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Respond to a rights request within one month (extendable by two further months for complex requests, with the person told why), and normally free of charge. Since 5 February 2026, if you need to ask the person to clarify or narrow a request, the DUAA lets you 'stop the clock': the one-month period pauses from when you ask until they respond.

On request, confirm whether you're processing someone's personal data and, if so, give them a copy of it plus supporting details: purposes, categories of data, recipients, retention period, and their other rights. Since Royal Assent of the DUAA (19 June 2025), you only need to carry out a 'reasonable and proportionate' search for the requested data — you are not required to turn over every system and process to answer every request.

Correct inaccurate personal data about a person without undue delay, and let them complete incomplete data, including by means of a supplementary statement.

Erase a person's personal data without undue delay when one of the Art. 17 grounds applies — e.g. it's no longer necessary for its original purpose, consent is withdrawn, or the person objects and you have no overriding ground to continue. Some exemptions apply (e.g. legal obligations, freedom of expression).

Restrict processing (mark data as 'do not use' rather than deleting it) when a person contests its accuracy, contests an objection, needs it preserved for a legal claim, or processing is otherwise unlawful but they'd rather restrict than erase.

When you rectify, erase, or restrict personal data, tell everyone you previously shared it with, unless that's impossible or disproportionately difficult. Tell the data subject who those recipients are if they ask.

Where processing is based on consent or contract and carried out by automated means, give the person their data in a structured, commonly used, machine-readable format, and transmit it directly to another controller where technically feasible.

Let a person object to processing based on legitimate interests (including recognised legitimate interests) or public task at any time on grounds relating to their situation, and stop unless you demonstrate compelling overriding grounds. Direct-marketing objections must always be honoured immediately, with no override.

People have rights around decisions based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect them. Since 5 February 2026, the DUAA reworks this regime: solely-automated significant decisions on ordinary personal data are permitted generally (not only under the old contract/law/consent grounds), provided you give the person safeguards — meaningful information about the decision, the ability to request human review, and the ability to contest it. Decisions based on special-category data still need an Art. 9 condition alongside these safeguards. Decide this in only if you run this kind of solely-automated decision-making with a significant effect.

Implement technical and organisational measures proportionate to the risk to ensure and be able to demonstrate that processing complies with UK GDPR, and review and update those measures as processing changes.

Build data protection into processing systems and business practices from the outset (by design) and configure defaults so only necessary personal data is processed for each specific purpose (by default) — not bolted on afterwards.

Use only processors that provide sufficient guarantees, and govern the relationship with a written contract (or other legal act) covering the subject matter, duration, nature and purpose of processing, the processor's obligations (confidentiality, sub-processor authorisation, assistance with rights requests and security, deletion/return of data on termination, and audit cooperation).

Maintain a written record of your processing activities — purposes, categories of data subjects and data, recipients, transfer safeguards, retention periods, and a general description of security measures. Keep it current and available to the Information Commission on request.

Implement technical and organisational measures appropriate to the risk — e.g. encryption and pseudonymisation, ensuring ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore data after an incident, and a process to regularly test and evaluate the effectiveness of those measures.

Notify the Information Commission of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Document the facts, effects, and remedial action taken, even for breaches you decide not to report.

When a breach is likely to result in a high risk to people's rights and freedoms, tell the affected individuals directly, in clear and plain language, without undue delay — unless an Art. 34(3) exception applies (e.g. the data was encrypted, or you've since mitigated the high risk).

Facilitate the making of complaints (e.g. a complaint form on your website), acknowledge a data-subject complaint about your processing within 30 days, and take appropriate steps to investigate and respond to it. This controller duty sits in the Data Protection Act 2018, s. 164A (inserted by DUAA s.103), in force since 19 June 2026. It is separate from the data subject's right to complain to the Information Commission under s. 165.

Processing special-category data (health, biometric, genetic, racial/ethnic origin, political/religious/philosophical beliefs, trade union membership, sex life or orientation) is prohibited by default and needs one of the Art. 9(2) conditions plus, in most cases, a matching substantial-public-interest or other condition from DPA 2018 Schedule 1 (each with its own documented policy requirement). Criminal-offence data (Art. 10) needs official authority or a DPA 2018 Schedule 1, Part 3 condition. Decide this in only if you actually process such data.

Before starting processing likely to result in a high risk to people's rights and freedoms (e.g. large-scale systematic monitoring, large-scale special-category processing, or use required by the Information Commission's Art. 35(4) list), carry out a DPIA describing the processing, assessing necessity and proportionality, and identifying risks and mitigations. Decide this in only if you run processing that meets the high-risk threshold.

If a DPIA indicates a high risk that you can't sufficiently mitigate, consult the Information Commission before starting the processing. Decide this in only if you actually reach that residual-high-risk conclusion in a DPIA.

Appoint a DPO if you're a public authority, your core activities involve large-scale regular and systematic monitoring, or large-scale special-category/criminal-offence data processing. The DPO must be given the resources and independence to advise on and monitor compliance, be a contact point for people and the Information Commission, and report to the highest level of management. Decide this in only if one of the appointment triggers applies to you.

If you're established outside the UK but process personal data of people in the UK under Art. 3(2) (offering goods/services to them, or monitoring their behaviour), designate a representative established in the UK, in writing, to act as your contact point for people and the Information Commission. Decide this in only if you have no UK establishment and Art. 3(2) applies to you.

Transferring personal data outside the UK needs a valid transfer mechanism: UK adequacy regulations recognising the destination country, appropriate safeguards (the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses), or — only for occasional, non-repetitive transfers — one of the Art. 49 derogations (e.g. explicit consent, contract necessity). Decide this in only if your processing actually involves transferring personal data outside the UK.