WHY GDPR MATTERS

The UK General Data Protection Regulation (UK GDPR) is a law that governs how personal data is handled in the UK. It came into effect on January 1, 2021.  The UK GDPR is based on the EU GDPR, but was modified after Brexit to better suit the UK.  

The UK GDPR protects the personal data of individuals, not legal entities.

 The Data Protection Act 2018 (2018 DPA) controls how personal information is used by organisations, including the government. It is the UKs implementation of GDPR.

All organisations responsible for using personal data have to follow strict rules called ‘data protection principles’. 

 The 2018 DPA also introduced stronger legal protection for more sensitive information, now known as Special Category Data.

 The Privacy and Electronic Communications Regulations (PECR) give people specific privacy rights in relation to electronic communications.  PECR regulates marketing calls, emails, texts and faxes; website cookies; keeping communications services secure; and customer privacy as regards traffic and location data, itemised billing, line identification, and directory listings.

 The maximum fine for a GDPR infringement in the UK is £17.5 million or 4% of the organization's annual global turnover, whichever is higher. 

 Personal data protected by GDPR includes names, ID numbers, phone numbers, financial data, online identifiers, like IP addresses and Information collected by tracking cookies.

Special category data includes race, ethnic background, political opinions, , religious beliefs, trade union membership, genetics, biometrics (where used for identification), health and sex life or orientation.

There are also separate safeguards for personal data relating to criminal convictions and offences.