Data protection regime

In brief

Data protection laws in the UK are intended to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly.

To help ensure that, UK data protection laws impose a large number of obligations on those ‘processing’ personal data (and on controllers of such processing) and grant rights to those whose personal data is processed (the ‘data subjects’). In summary, ‘processing’ includes doing almost anything with personal data, including storing, sharing, deleting or using it.

This subtopic primarily addresses UK data protection laws that apply to ‘general’ processing of personal data. The United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) regime is referred to as ‘general’ since there are special regimes applicable to the processing of personal data in niche areas such as law enforcement processing and processing by the intelligence services that are unlikely to be relevant to most organisations.

For a more detailed high-level introduction to the data protection landscape in the UK, including non-UK GDPR regimes, see Practice Note: Data protection law—new starter guide.

The obligations under the UK GDPR are extensive,