Profile information Account settings
Help Contact us
Sign up Log in
Help Contact us

Processing personal data

Personal data is information, held electronically or physically, relating to individuals only (ie not companies or other organisations) who can be personally identified from that data (on its own or with other data held). For more information on what personal data is, read Data protection.

The term 'processing' is any use of personal data (eg names and addresses), other than for personal reasons. It includes:

  • obtaining

  • recording

  • storing

  • organising

  • retrieving personal data

People who process personal data can either be 'data controllers' or 'data processors'. 

Data controller

The data controller is the main decision-maker. They decided on the purposes for and means of processing personal data. In other words, the data controller is the person who says how and why personal data is processed.

Data processor

The data processor carries out the instructions of the data controller in its processing of personal data. In other words, the data processor is the person who acts on behalf of, and only on the instructions of, the data controller. 

Businesses will only be able to process personal data collected if one (or more) of the following six grounds have been met.

Failure to comply with one or more of the grounds will result in a criminal offence.


Controllers can obtain the consent of data subjects to process their personal data. Consent must be:

  • freely given

  • specific

  • informed

  • unambiguous, and

  • as easy to withdraw as it was to provide

Consent can be given by way of a statement or affirmative action. Affirmative action means that it is no longer recommended that businesses rely on pre-ticked boxes.

Consent cannot be given by a child under the age of 16 unless there is parental consent (reasonable efforts must be taken to ensure that, where consent is provided by the parent, it is genuine).

The burden of proof lies with the data controller who must show that consent was validly obtained. As such, the controller should regularly confirm, review and update consent.

Performance of a contract

Processing is necessary for the performance of a contract or where it is necessary in order to ‘take steps’ at the request of the data subject before entering into the contract.

Compliance with a legal obligation

Where data is processed in order to comply with a legal obligation. The obligation does not have to be required by legislation or statute, but it must be clear having regard to the laws of the UK. For example, employers may be required to process certain health-related data to comply with their health and safety duties.

Vital interests of the data subject

Processing is required to protect the vital interests of the data subject or another individual.

Vital interests include interests essential for the life of the data subject or processing data for humanitarian purposes and, in particular, cases where a disaster has struck.

Public interest

Processing is necessary for performing a task that is in the public interest or in the exercise of official authority vested in the data controller. For example, a local authority using personal data to collect council tax.

Legitimate interests of the data controller

Legitimate interests can include commercial interests, individual interests or broader societal benefits. Processing is necessary for the legitimate interests pursued by the data controller or by a third party, as long as the processing does not override the fundamental rights and freedoms of the data subject (eg for network and information security or for the prevention of fraud). 

Public authorities and any party dealing with children (as a child's interests will always override the interests of a data controller) are not able to rely on this ground.

We use cookies to provide the best experience