Data Protection: UK GDPR and the DPA 2018

Taking the names off a list does not necessarily make it anonymous. If the people can still be worked out from what is left, such as a class list reduced to dates of birth and postcodes, it is still personal data. Information is only outside the law when people genuinely cannot be identified from it.

How sensitive an organisation has labelled a document does not settle the question either. A staff rota marked Internal is full of personal data. Data Classification explains why the label and the law are separate questions.

Some kinds of personal data could cause serious harm or discrimination if misused, and the law protects them more strongly. This is special category data. It is information about a person’s:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• health;
• sex life or sexual orientation;
• genetic data, and biometric data such as fingerprints when used to identify someone.

So a register saying that a named pupil attended on Tuesday is personal data. The same register with a note that the pupil has asthma contains special category data, and needs more care.

Two things that sound similar are not special category data: information that is merely confidential to a business, and information about criminal offences, which has separate rules of its own.

The plain statement at the start of this lesson is, in the law, seven principles. The table gives each one in plain words and applies it to an attendance register kept by a fictional training organisation.

The first six are in Article 5(1) of the UK GDPR and the seventh, accountability, in Article 5(2). They are principles to apply with judgement, not a checklist that guarantees compliance. See current Article 5 and the ICO principles guide.

The first principle says an organisation needs a proper reason for using someone’s personal data. The law lists the acceptable reasons and calls each a lawful basis. An organisation must be able to say which one applies to each thing it does with personal data, and must decide that before it starts.

Two points clear up the commonest mistakes.

• Consent is only one of the bases. It is often not the right one, and it is not needed when another basis applies.
• A basis belongs to a purpose. Having a basis for keeping a register does not provide one for doing something else with it.

There are seven lawful bases. Six have been in the law since it came into force in 2018, and a seventh was added in 2025. Older books, slides and courses show six, so it is worth knowing both the six and the addition.

Six long-standing bases

Current-law clarification: there are now seven Article 6 bases in the ICO’s guidance. Recognised legitimate interest, introduced by the Data (Use and Access) Act 2025, appears in Article 6(1)(ea). It is distinct from ordinary legitimate interests under Article 6(1)(f). The six cards must not be treated as an exhaustive current list.

Apply the basis to the purpose

Each basis has a test. The question is always whether the facts meet it, not which is most convenient.

1. Consent. The person has a real choice and can change their mind. A tick-box that must be ticked to use a service is not consent, because refusing is not a real option.
2. Contract. The organisation needs the data to do what it has agreed with that person: a shop needs an address to deliver an order. Writing something into a contract does not make it necessary.
3. Legal obligation. A law requires it, as when an employer reports pay to the tax authority. An internal rule or a promise to a customer is not a legal obligation.
4. Vital interests. It is needed to protect someone’s life, as when a hospital is told of an unconscious patient’s allergy. It is for emergencies, not routine administration.
5. Public task. A public body needs it to carry out a function that the law gives it. Being generally useful to society is not enough.
6. Legitimate interests. The organisation has a genuine reason, the data is necessary for it, and the reason is not outweighed by the effect on the person. All three parts must be thought through and written down.
7. Recognised legitimate interest (added in 2025). A short list of purposes set out in the law itself, including safeguarding vulnerable people and preventing crime. Because Parliament has already weighed them, no balancing test is needed, but the purpose must be one on the list and the data must be necessary for it. It is not a general permission.

Public authorities cannot rely on either kind of legitimate interest for their official work; they use public task.

Two roles decide who carries which duties.

• The controller is the organisation that decides why personal data is used and how.
• A processor is a separate organisation that handles the data on the controller’s behalf and on its instructions.

A simple test: whose purpose is it? A school that keeps pupil records is the controller. The company whose online system stores those records for the school, and does nothing else with them, is a processor.

What an organisation actually does decides its role, not what the contract calls it. The same company can be a processor for its customers’ data and a controller for its own staff and billing records. A supplier that starts using the data for purposes of its own has stopped being a mere processor.

Using a processor does not hand over the controller’s responsibility. The controller must choose one that can protect the data, and the law requires a written contract between them. See the ICO’s controller and processor guidance.

The one used most often is the right of access. Suppose a parent writes to the sports club: “Please send me everything you hold about my daughter.” The club has to find it all, in the register, in emails and in the booking app, and send a copy, generally within one month.

That is why rights matter to anyone who looks after systems: an organisation must be able to find, correct, copy and delete one person’s data wherever it is held, including at its processors.

Most of the rights have limits and exceptions, and some of the procedure was changed by the Data (Use and Access) Act 2025, so check the ICO’s current guidance before relying on a detail.