Data Protection Principles
Data Protection Principles
The UK General Data Protection Regulation (UK GDPR) is the law that governs how organisations collect, store, and use personal data in the UK. It was adapted from the EU's GDPR and is enforced by the Information Commissioner's Office (ICO).
Any organisation that handles personal data — whether that's a hospital, a school, or an online retailer — must comply with UK GDPR. Breaching it can result in hefty fines, legal action, and serious damage to an organisation's reputation.
At the heart of UK GDPR are eight data protection principles. These set out the standards that organisations must meet whenever they process personal data. Think of them as a checklist of responsible behaviour — every principle must be followed, not just the convenient ones.
Lawful Processing
Organisations must have a legal basis to collect and use someone's data — they cannot simply do so because it's convenient. The UK GDPR sets out six lawful bases, the most common being consent (the person has agreed), contract (processing is needed to fulfil an agreement), and legitimate interest (the organisation has a genuine, proportionate reason). For example, an online shop can process your address because it's necessary to deliver your order. Without a lawful basis, any processing is illegal.
Unlock All Revision Notes
Syllabus-perfect, clutter-free summaries — so you only study what really matters.
Start your 7-day free trial (no card needed!)Existing User? Sign In