UK GDPR / DPA 2018

Who it applies to

Controllers and processors established in the UK, and organisations outside the UK that offer goods or services to, or monitor, people in the UK.

Key requirements

• Lawful basis and the data protection principles, broadly mirroring the EU GDPR.
• Individual rights including access, erasure, objection and rights around automated decisions.
• Appropriate security of processing.
• DPIAs for high-risk processing and records of processing.
• Safeguards for international transfers, such as adequacy regulations or the International Data Transfer Agreement.
• Payment of the data protection fee to the ICO unless exempt.

Breach and incident notification

Report a notifiable personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Tell affected individuals without undue delay when there is a high risk to them.

Penalties

Fines of up to GBP 17.5 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

Go deeper