How can we help?


UK data protection: Important basics

We live in a data-rich world.

In our fast-developing technological era, we find ourselves swimming in a sea of data. From personal information shared on social media to sensitive business records stored in the cloud, data surrounds us. Sometimes, data protection can seem like unhelpful red tape. At other times, it is critical to cultivating a trustworthy reputation. Either way, organisations face data protection challenges in various spheres, including employment and commercial practice.

As the digital tide rises, understanding data protection terms becomes essential for everyone – whether you are an individual, a business owner, or a tech enthusiast.

Below are key concepts to keep you grounded as we navigate an evolving and complex field.

Personal data

Personal data is not just a string of characters, and the definition is not limited to the obvious.  Personal data means any information relating to an identified or identifiable natural person (the ‘data subject’). A person can be identified directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or they may be identified by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.  It is a fairly wide definition.

Types of personal data that are considered particularly sensitive are known as special category data and are governed by different rules. Examples are health records, racial or ethnic origin, religious beliefs, sexual orientation and biometric data. This is increasingly relevant as many organisations seek to understand and reflect their stakeholders’ diversity and grapple with new levels of health disclosures.

Data subject

Imagine a spotlight on centre stage – the data subject steps into it. They are the individuals whose data we handle. Whether you are a marketer analysing consumer behaviour or a HR manager managing employee records, data subjects are at the heart of it all.


Data processors process personal data on behalf of the controller. They may process personal data in a variety of ways, including collecting, organising, analysing and sharing it. A lawful basis is needed to carry out processing activities, and different rationales apply in different circumstances.

Data controller and data processor

These key terms are used to describe the two main parties who will be processing an individual’s personal data. For a detailed explanation of data controllers and data processors, check out our article here.

Sana Nahas

Trainee Solicitor

View profile

‪+44 118 960 4611

As the digital tide rises, understanding data protection terms becomes essential for everyone – whether you are an individual, a business owner, or a tech enthusiast.

Individual rights

Data subjects have several specific rights – the most popular being the data subject access request (“DSAR”), where individuals may ask for information about how their data has been processed, and for access to, and copies of, their personal data held by an organisation.

Data subjects have a right to be provided with information about data processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Other rights include the right to rectification, erasure, and to object to and/or restrict processing. These are all routes for individuals to raise concerns about the retention of their data, and the appropriateness and accuracy of its processing.

The right to data portability is a relatively obscure right designed to allow individuals to request that their data is in a structured, machine-readable format to move it elsewhere.


Data protection and cyber security go together, so comprehensive security audits and regular internal training should be on the agenda. This is particularly the case as workplaces become more dispersed and multiple platforms, technologies and devices are used.

But data breaches are not always the result of sophisticated attacks – often human error is just as culpable. It is important that breach processes are clear, so issues can be escalated and resolved and any reporting to the regulator or data subjects can be actioned within the required deadlines.

Sharing and transfers

Data sharing is necessary in many contexts – increasingly so, as organisations outsource various functions to specialist providers and work collaboratively to tackle global issues.

Compliance with data regulations should enhance trust in those commercial relationships. However, on a practical level, navigating different regulatory expectations can be problematic.

International data transfers are restricted. There are additional rules – ranging from how the comparable standards in the importers’ jurisdiction are assessed and evidenced, to the risk assessments, agreements, and obligations necessary to maintain the required levels of data protection. The applicable regimes will depend on the jurisdictions involved.

Key data protection laws

The UK GDPR retains the EU GDPR standards but operates as domestic law, and it sits alongside the amended Data Protection Act 2018. While the principles, rights and obligations remain the same, there are implications for data transfers between the UK and the European Economic Area.

If you have any questions, please contact our data protection team, who would be happy to help.

About this article

This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.

Sana Nahas

Trainee Solicitor

View profile

‪+44 118 960 4611

About this article

Read, listen and watch our latest insights

  • 19 June 2024
  • Employment

Are your employee benefits attracting and retaining top talent

The country’s economic outlook continues to improve, but many companies and employees are still under pressure due to high inflation and the resulting cost of living crisis.

  • 18 June 2024
  • Employment

Clarkslegal representing UK employers on the global stage

I recently returned from the 112th Session of the International Labour Organisation’s International Labour Conference (ILC) in Geneva, which I had the privilege of attending with the Confederation of British Industry (CBI), in order to represent UK employers on this global stage.

  • 17 June 2024
  • Employment

Pride Month

June has been a month of dreary wet weather.  Luckily, the vibrant colours and messages of acceptance for the LGBTQ+ community have been something to celebrate, despite the weather!

  • 11 June 2024
  • Immigration

UK Immigration Roundup – May to June 2024

As the UK approaches the upcoming general election, immigration remains a focal issue in political discussions. The Conservative party’s recent proposal to cap visas for skilled migrant workers has alarmed various industries who are concerned that a limit to migration could harm vital sectors of the UK economy.

  • 06 June 2024
  • Employment

Talking Employment Law: What does the new Worker Protection Act 2023 mean for employers?

In this podcast, Lucy Densham Brown and Shauna Jones, members of the employment team, will review the new Worker Protection Act 2023 and provide some guidance on how employers should review their policies in preparation for October.

  • 03 June 2024
  • Commercial Real Estate

Sustainability and commercial property: green leases  

Climate change is considered by many the biggest threat we are facing today. With the UK said to have one of the oldest housing/building stocks, the focus on a building’s environmental performance and sustainability has never been more critical.