UK data protection: Important basics

We live in a data-rich world.

In our fast-developing technological era, we find ourselves swimming in a sea of data. From personal information shared on social media to sensitive business records stored in the cloud, data surrounds us. Sometimes, data protection can seem like unhelpful red tape. At other times, it is critical to cultivating a trustworthy reputation. Either way, organisations face data protection challenges in various spheres, including employment and commercial practice.

As the digital tide rises, understanding data protection terms becomes essential for everyone – whether you are an individual, a business owner, or a tech enthusiast.

Below are key concepts to keep you grounded as we navigate an evolving and complex field.

Personal data

Personal data is not just a string of characters, and the definition is not limited to the obvious.  Personal data means any information relating to an identified or identifiable natural person (the ‘data subject’). A person can be identified directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or they may be identified by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.  It is a fairly wide definition.

Types of personal data that are considered particularly sensitive are known as special category data and are governed by different rules. Examples are health records, racial or ethnic origin, religious beliefs, sexual orientation and biometric data. This is increasingly relevant as many organisations seek to understand and reflect their stakeholders’ diversity and grapple with new levels of health disclosures.

Data subject

Imagine a spotlight on centre stage – the data subject steps into it. They are the individuals whose data we handle. Whether you are a marketer analysing consumer behaviour or a HR manager managing employee records, data subjects are at the heart of it all.

Processing

Data processors process personal data on behalf of the controller. They may process personal data in a variety of ways, including collecting, organising, analysing and sharing it. A lawful basis is needed to carry out processing activities, and different rationales apply in different circumstances.

Data controller and data processor

These key terms are used to describe the two main parties who will be processing an individual’s personal data. For a detailed explanation of data controllers and data processors, check out our article.

Individual rights

Data subjects have several specific rights – the most popular being the data subject access request (“DSAR”), where individuals may ask for information about how their data has been processed, and for access to, and copies of, their personal data held by an organisation.

Data subjects have a right to be provided with information about data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Other rights include the right to rectification, erasure, and to object to and/or restrict processing. These are all routes for individuals to raise concerns about the retention of their data, and the appropriateness and accuracy of its processing.

The right to data portability is a relatively obscure right designed to allow individuals to request that their data is in a structured, machine-readable format to move it elsewhere.

Security

Data protection and cyber security go together, so comprehensive security audits and regular internal training should be on the agenda. This is particularly the case as workplaces become more dispersed and multiple platforms, technologies and devices are used.

But data breaches are not always the result of sophisticated attacks – often human error is just as culpable. It is important that breach processes are clear, so issues can be escalated and resolved and any reporting to the regulator or data subjects can be actioned within the required deadlines.

Sharing and transfers

Data sharing is necessary in many contexts – increasingly so, as organisations outsource various functions to specialist providers and work collaboratively to tackle global issues.

Compliance with data regulations should enhance trust in those commercial relationships. However, on a practical level, navigating different regulatory expectations can be problematic.

International data transfers are restricted. There are additional rules – ranging from how the comparable standards in the importers’ jurisdiction are assessed and evidenced, to the risk assessments, agreements, and obligations necessary to maintain the required levels of data protection. The applicable regimes will depend on the jurisdictions involved.

Key data protection laws

The UK GDPR retains the EU GDPR standards but operates as domestic law, and it sits alongside the amended Data Protection Act 2018. While the principles, rights and obligations remain the same, there are implications for data transfers between the UK and the European Economic Area.

If you have any questions, please contact our data protection lawyers, who would be happy to help.