Understanding the principles which underpin the UK GDPR can help you to develop a better understanding of the legislation.
As the ICO says, the principles “should lie at the heart of your approach to processing personal data”.
So what are they?
Lawfulness, Fairness and Transparency
There must be a lawful basis to permit the use of personal data.
These bases are set out in Article 6 of the UK GDPR (plus the conditions under Article 9 where you are processing special category data and Article 10 for criminal offence data).
You should process personal data in a way which would not be unexpected, assess how the processing will affect the individuals concerned and you must explain clearly how personal data will be used (the last often done via privacy notices).
Purpose Limitation
Personal data must only be used for specified, explicit, and legitimate purposes.
Before you collect personal data, you should carefully consider what you intend to use it for, record this, and ensure you share this information with individuals in your privacy information.
Any proposed change in purpose/additional purpose will require careful consideration to ensure it can be done compliantly.
Having a clearly set purpose for your processing will increase trust in your organisation and how it handles personal data.
Data Minimisation
You should only collect and use personal data that you need for your purposes.
For example, a form for people to sign up to an email newsletter sent by a furniture retailer should include a field for the customer’s email address but it is unlikely, for example, that their date of birth will be needed.
Don’t collect personal data on the off chance you will need it later and review the data you hold regularly to ensure you delete anything you no longer need.
Accuracy
You must take reasonable steps to ensure that personal data is accurate and kept up to date (where up-to-date data is necessary for the processing).
Inaccurate data can have potentially damaging consequences, for example, if a customer informs a bank of their new address but the bank does not update this on their system, this could result in sensitive financial information being sent to the wrong address.
You must also take reasonable steps to correct inaccurate data as soon as possible.
Storage Limitation
You must only keep personal data for as long as you need it for the purposes for which you collected it.
There are no specific time limits set by the UK GDPR, it depends on how long you need the personal data for your purpose.
You will also need to document how long you keep personal data.
Integrity and Confidentiality
You must have appropriate measures in place to keep personal data secure, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, by using appropriate technical and organisational measures.
Such measures might include, by way of example, the use of firewalls, password protection, physical security measures such as access cards to enter an office, and methods to restore access to personal data in the event this is lost.
The key is that the measures must be appropriate, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks (including consideration of likelihood and severity of the same) presented by the processing.
Accountability
The accountability principle makes you responsible for complying with the UK GDPR and being able to show that you are complying with it.
You will need to put in place technical and organisational measures to achieve this.
There are many different measures which may be applicable (some of which are mandatory) including, for example, maintaining clear and up-to-date policies and procedures, documenting your processing activities, conducting data protection impact assessments where necessary, putting in place appropriate contractual provisions with third parties who you share data with, and recording and reporting breaches, to name but a few.
Contact Us
If you are interested in improving data protection compliance in your business, please get in touch by emailing hello@hellodpo.com to contact a member of the team.
