General Data Protection Regulation

The UK GDPR (retained in UK law post-Brexit, alongside the Data Protection Act 2018) regulates how organisations collect, use, store, and share personal data. Organisations must have a lawful basis for processing (consent, legitimate interests, contract, legal obligation, vital interests, or public task) and must tell individuals how their data is used via a privacy notice. Data subjects have rights including access (subject access request — SAR), erasure ('right to be forgotten'), rectification, restriction, and portability. The Information Commissioner's Office (ICO) enforces UK GDPR and can impose fines of up to £17.5 million or 4% of global annual turnover (whichever is higher) for the most serious breaches. Personal data breaches that risk individuals' rights must be reported to the ICO within 72 hours of becoming aware of them. Public authorities, and organisations whose core activities involve large-scale monitoring or large-scale processing of special category data, must appoint a Data Protection Officer (DPO).

What it means in practice. UK GDPR is built on six principles and one overarching duty: you must be able to demonstrate compliance, not merely assert it. In practice that means knowing what personal data you hold, why you hold it, on what lawful basis, who you share it with, and how long you keep it. For individuals, the practical value of the regime is the set of rights it hands you — most importantly the right to ask any organisation what it holds about you and to have inaccurate data corrected or unlawfully held data deleted.

A worked example. Chris suspects a former employer is circulating an inaccurate account of why he left. He makes a subject access request by email, giving enough detail to identify himself. The employer must respond within one month, free of charge, providing a copy of his personal data along with the purposes of processing, the recipients, and the retention period. The disclosure reveals an internal note containing a factual error about his sickness record. He exercises the right to rectification, and because the note was shared with a recruitment agency, the employer must tell that recipient about the correction too.

Common pitfalls. Consent is over-used: it is only one of six lawful bases, it must be freely given and as easy to withdraw as to give, and it is usually the wrong basis for employment data because the power imbalance undermines it. Organisations also wrongly treat the right to erasure as absolute — it does not apply where the data is needed for a legal obligation or the establishment or defence of legal claims. And the 72-hour breach notification deadline runs from awareness, not from the point you finish investigating.

How it relates to other terms. The organisation deciding why and how data is processed is the data controller, and a supplier acting on its instructions is a processor. Enforcement sits with the Information Commissioner's Office. The regime is more fully described under UK GDPR and works alongside the Data Protection Act 2018, while requests for information held by public bodies about anything other than yourself go through freedom of information instead.

What to do next. Read our UK GDPR for individuals guide to see which rights apply to you, then use making a subject access request to get a copy of your data. If your information has been lost or disclosed without authority, read your rights after a data breach before contacting the ICO.