What is GDPR?

Personal data is defined as information relating to individuals:

• Who can be identified or who are identifiable directly from the information in question, or
• Who can be indirectly identified from that information in combination with other information

Personal data may also include special categories of personal data or criminal conviction and offences data. These are considered to be more sensitive and you may only process them in more limited circumstances.

Information about companies or public authorities is not personal data. However, information about individuals acting as sole traders, employees, partners and company directors where they are individually identifiable and the information relates to them as an individual may constitute personal data.

When using personal data, there are two types of users: Controllers and Processors.  A Controller determines, either jointly or alone, the purposes and means of processing, in other words the why and how of processing.  A Processor, on the other hand, processes personal data on behalf of the Controller. It is important to understand the different roles as the law treats them differently.  See the following question and answer for Processors’ data protection responsibilities.

When using personal data, Controllers must comply with the data protection principles.  Personal data shall be:

• Processed lawfully, fairly and in a transparent manner in relation to the data subject
• Collected for specified, explicit and legitimate purposes
• Adequate, relevant and limited to what is necessary
• Accurate and kept up to date
• Kept for no longer than is necessary
• Kept secure, using both organisational, contractual and technical measures designed to your processing activity and resources

This involves ensuring the correct policies, procedures, notices and records are in place to document processing activity and compliance across the organisation.  An example of this may be undertaking Data Protection Impact Assessments as necessary.   Controllers may also require to appoint a Data Protection Officer to support good data protection compliance across your organisation.

A Processor is any entity which processes personal data on behalf of the Controller. They act on behalf of, and only on the instructions of, the relevant Controller.

Processors may handle a broad range of processing activities on behalf of a Controller, such as:

• Cloud-based data storage
• IT services
• Human resources functions such as payroll
• Marketing

The crucial difference between Controllers and Processors is that Processors exercise no control over what data is collected and what it is used for; they merely facilitate the collection of data and use it for set purposes decided by the Controller.  

If you are a Processor, you do not have the same obligations as a Controller under the UK GDPR but you do have a number of direct obligations of your own. These include:

• Requirements to only process personal data according to the Controller's instructions
• Restrictions on engaging other Processors
• Requirements to implement appropriate technical and organisational measures to secure personal data
• Data breach notification requirements
• Requirements to appoint a Data Protection Officer in certain situations
• Restrictions on transferring personal data outside the UK
• Record-keeping requirements

The UK GDPR provides individual data subjects with a range of rights, with the most common being the right to access their personal data. Individuals can exercise these rights at any time and the Data Controller has one month to respond, which can be extended by a further two months in certain circumstances. 

If your organisation fails to handle data subject rights appropriately, it could face a penalty of the greater of 4% of annual turnover or £17.5 million.  Our Data Protection team can support your organisation with handling data subject rights requests including redaction.

Mishandling of personal data is likely to result in an infringement of the rights of individuals, a breakdown of trust your staff, clients or customers have in your organisation, reputational damage, and may lead to a personal data breach. 

A serious mishandling of personal data could lead to a penalty being imposed by the UK regulator, the Information Commissioner’s Office (ICO) up to the greater of 4% of global turnover or £17.5 million.  The ICO also has wider investigatory and corrective powers, as well as the power under the Privacy and Electronic Communications Regulations 2003 to impose a monetary penalty on a Data Controller of up to £500,000.  Our Data Protection team can support your organisation with mitigating the risk of a personal data breach and ensuring an effective response if there is a breach.