Complying with the GDPR

The GDPR and the DPA apply to businesses that store or handle personal data (ie identifiable information relating to individuals). People handling personal data can either be 'data controllers' or 'data processors': 

• The controller is the person who says how and why personal data is processed (eg a city council operating CCTV cameras). 

• The processor is the person who acts on the controller’s behalf (eg IT services). 

For more information, read Processing personal data.

The GDPR primarily applies to businesses established in the UK but also applies to businesses based outside the UK that offer goods and services to UK residents. This means that companies will have to comply with the GDPR regardless of where they store or handle data, as long as they are processing UK citizens’ personal data.

UK businesses will also need to comply with the EU GDPR where they are processing EU citizens’ personal data.

On 1 January 2021, the UK became a ‘third country’ (a non-EU country), for the purpose of personal data transfer outside the EU.  The EU assessed whether the UK should receive an adequacy decision that would provide a solution for EU-UK data transfers. 

In the long term, this will require an ‘adequacy decision’ by the European Commission on the suitability of the UK’s data protection framework under the DPA 2018. It may also result in a legally binding data protection agreement between the EU and UK. On 14 April 2021, the European Data Protection Board announced that it had adopted two Opinions on the draft UK adequacy decisions. The next step is for the European Commission to seek approval from representatives from each EU Member State and then adopt a final decision.

In the short term, businesses can continue to transfer personal data between the EU and UK without the need to take additional measures (eg entering into standard contractual clauses). The Trade and Cooperation Agreement between the EU and UK states that until 30 June 2021, the transfers of personal data from the EU to the UK will not be considered a transfer to a third country. This is subject to certain safeguards (ie the UK not amending its data protection laws without the EU’s agreement).

Ask a lawyer if you are unsure whether the GDPR applies to your business. 

The GDPR reinforces the established principles governing data protection. These principles include processing data lawfully, obtaining valid consent from individuals you are collecting data from, and making sure the rights of individuals are protected (ie the right to object to their data being processed). 

Lawful processing 

When collecting personal data, you must make sure the data is:

• used fairly and lawfully

• used for limited, specifically stated purposes

• used in a way that is adequate, relevant and not excessive

• kept for no longer than is necessary

• kept safe and secure

• not transferred outside the UK or European Economic Area (EEA) without adequate protection

Consent

For consent to be valid, it must be freely given, limited to a  specific purpose, informed and unambiguous. It must consist of clear affirmative action, therefore silence, pre-ticked boxes or inactivity don't constitute valid consent. In addition, consent to process 'sensitive personal data' or data that comes within the 'special categories of personal data' (ie information about racial origin, political opinions, religious beliefs, health, sexual orientation or criminal records) and consent to transfer personal data outside the UK or EU must be explicit. 

Individuals can also withdraw their consent at any time and consent must be as easy to withdraw as it was to give (eg if data subjects simply ticked a box to express their consent, they should be able to withdraw the consent as easily). 

Individuals' rights 

The GDPR provides additional rights for individuals, including:

• the right to erasure (or 'right to be forgotten'): individuals have the right to ask companies holding data about them to erase that data upon request, if there's no compelling reason to continue processing the data. 

• the right to access data: data processors must comply with a request to access data without delay, and at the latest within one month of the request (this can be extended to two months if the request is too complex). However, you can refuse to respond to the request if it is manifestly unfounded or excessive.

• the right to data portability: when data processing is carried out by automated means, individuals have the right to access their personal data in a machine-readable format (ie in a way that is portable and safe).

Breach notification

All organisations must report data breaches to the relevant supervisory authority and if the breach is a high risk, to the affected individuals. Data breaches are breaches of security that lead for example to the destruction, loss, alteration or unauthorised disclosure of personal data. If feasible the breach must be reported within 72 hours.

The GDPR requires you not only to comply with data protection principles but also to demonstrate that you comply with them, through the implementation of specific policies and procedures. Follow these few steps to make sure your business complies with the law:

• Evaluate whether the GDPR applies to your business.

• Make sure you process data lawfully (ie that personal data is stored and handled responsibly and securely, and is not kept longer than necessary). This might involve applying suitable security measures. For example if you own a mobile application, your developers should encrypt and secure any data that moves between your app and the server, in addition to adequate hashing of user passwords.

• Review your existing process to obtain consent from data subjects and ensure consent is valid. You should keep some form of record of consent (ie how and when consent was given, and by whom).

• Update/develop a clear Privacy policy in which you’ll indicate what personal data is being collected, the purpose for collection, and how individuals can access data.

• Consider how you will deal with individuals' requests to delete their data and make sure you are able to erase data if someone requests you to do so.

• Ensure you offer a proper process for individuals to withdraw consent at any time and notify them of their right to do so.

• Appoint a Data Protection Officer within your business to be responsible for ensuring data protection compliance.

• Prepare for the new data breach reporting requirements. You may need to appoint a specific person or set up a dedicated unit within your business to deal with data breaches.

Individuals or businesses that do not comply with data protection law will be subject to a fine of up to 4% of their total global annual turnover or £17.5 million, whichever is higher. Supervisory authorities will also have a wide range of powers, including the power to audit businesses,  issue warnings and give temporary or permanent bans on data processing.