Data protection

For individuals: be aware of how information you give to others can be used. You have certain rights relating to data held about you, including:

• the right to access your data and be informed about how your data is being processed;
• the right to have your data rectified if it's inaccurate or incomplete;
• the right to object to the processing; and
• the right to have your data erased in certain circumstances.

For business owners: if you handle personal information (and, let’s face it, you are always going to be handling personal information because as a business you have to keep records on your customers), you have a number of legal obligations to protect that information.

Personal data is information (whether held electronically or physically) relating to individuals only (ie not companies or other organisations) who can be personally identified from that data (on its own or with other data held). It includes:

• names
• addresses (including email addresses)
• telephone numbers
• dates of birth
• job titles
• online identifiers (eg IP addresses)

There is a further 'special category' of 'sensitive personal data' which includes information about:

• racial or ethnic origin
• political opinions
• religious or similar beliefs
• trade union membership
• physical or mental health or condition
• sexual life
• biometrics (eg fingerprint data/facial images)
• genetics

The DPA’s requirements are even stricter when it comes to sensitive personal data. Information about criminal convictions is treated separately and subject to even tighter controls.

'Processing' is any use of personal data (other than for personal reasons). It includes:

• obtaining
• recording
• storing
• organising
• retrieving personal data

For further information, read Processing personal data.

Data subjects are natural persons from whom or about whom you collect information in connection with your business and its operations. For example, if you run an online business, you'll collect information about:

• your customers, ie the people who buy your products
• the people who work in the business, ie employees/consultants

You must make sure the information is:

• processed fairly, lawfully and in a transparent manner
• collected for specified, explicit and legitimate purposes
• adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed
• accurate and kept up to date
• kept in a form which enables identification of data subjects for no longer than is necessary
• processed in a way that ensures it is appropriately secure
• not transferred outside the European Economic Area (EEA) without adequate protection

These are strict rules known as the 'data protection principles’. How they are interpreted and enforced depends upon the perceived risk of harm arising from failures. Therefore today, if you collect a person’s credit card details, you must keep that data safe and secure at all times and not send it unencrypted. The ICO has guidance on this topic.

Moreover, if you collect personal information, you are responsible for and must be able to demonstrate compliance with the law on data protection. This is referred to as 'accountability' in the legislation.

You must follow the rules on data protection in relation to information you retain about staff, customers and account holders. This applies when, for example, you:

• recruit employees
• retain records about your employees
• need to access employees’ emails or computer
• market your goods and/or services to customers
• use a form of security such as CCTV

You can find useful information about data protection and dealing with your staff on the government’s website and you can download the Information Commissioner’s advice for organisations.

From 25 May 2018, data controllers must pay the ICO a data protection fee, unless they are exempt. Details of how to go about this can be found on the Information commissioner’s office’s website.

You should nominate someone within your business to be responsible for ensuring data protection compliance. The Data Protection Officer (DPO) should become familiar with data protection requirements and audit the organisation’s data processing activities. The DPO should also consider drawing up a data protection and data security policy and other guidance to make everyone within the organisation aware of the data protection requirements.

Where you collect personal data through a website, you should build into your website a privacy policy which informs individuals about the proposed processing of their personal data.

The legislation imposes restrictions on the transfer of personal data outside the European Union to international organisations (or 'third countries'). For more information, read our guide on International data transfers of personal data.

From 1 January 2021, the GDPR was retained in UK law (as the UK GDPR) and continues to be read alongside the DPA. On the same date, the UK became a ‘third country’ (a non-EU country) for the purpose of personal data transfers outside the EU. 

In the long term, this will require an ‘adequacy decision’ by the European Commission on the suitability of the UK’s data protection framework under the DPA 2018. It may also result in a legally-binding data protection agreement between the EU and UK.

In the short term, businesses can continue to transfer personal data between the EU and UK without the need to take additional measures (eg entering into the standard contractual clauses). The Trade and Cooperation Agreement between the EU and UK states that until 30 June 2021, the transfers of personal data from the EU to the UK will not be considered a transfer to a third country. This is subject to certain safeguards (ie the UK not amending its data protection laws without the EU’s agreement).

UK data controllers and processors may also need to appoint EU-based representatives from 1 January 2021. This will be required where a business:

• has no offices, branches or other establishments in the EEA, and

• offers goods or services to individuals in the EEA or monitors the behaviour of individuals in the EEA

Where this applies to your business, you must authorise the representative, in writing, to: 

• act on your behalf regarding your GDPR compliance

• deal with any supervisory authorities or data subjects.

The representative can be an individual, company or organisation established in the EEA, and must be able to represent you regarding your obligations under the GDPR.