What's on Practical Law?

Overview of UK GDPR

Practical Law UK Practice Note Overview w-013-3757 (Approx. 145 pages)

Overview of UK GDPR

by Sian Rudgard of Hogan Lovells, Mac Macmillan (formerly of Hogan Lovells) and Practical Law Data Protection
Related Content
An overview of the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
Note: this resource is affected by recent developments relating to international transfers of personal data. Pending a full update of the resource, please see this summary of the relevant developments.
Free Practical Law trial
To access this resource, sign up for a free trial of Practical Law.
Free trial
Already registered? Sign in to your account.
Contact us
Our Customer Support team are on hand 24 hours a day to help with queries:
+44 345 600 9355
Contact customer support
Maintained
Resource Type Practice note: overview
Jurisdictions
  • England
  • Northern Ireland
  • Scotland
  • United Kingdom
  • Wales
Related Content
 
Toggle Table of ContentsTable of Contents

Ctrl + Alt + T to open/close

  1. 1Scope of this note
    1. End of UK-EU transition period and extra-territorial effect of EU GDPR
    2. Frozen GDPR and legacy data
    3. Status of recitals to the UK GDPR
    4. Status of EDPB guidelines
  2. 2DCMS consultation on the future of the UK data protection regime
  3. 3COVID-19 and data protection
  4. 4GDPR and Data Protection Act 2018: background
    1. Law Enforcement Directive
  5. 5Data Protection Act 2018
    1. Structure of the DPA 2018
  6. 6Effect of the Brexit Regulations
    1. Immigration Exemption
  7. 7Regulatory guidance
  8. 8Material scope of the UK GDPR
  9. 9Application of the UK GDPR
    1. Application outside the UK
    2. EU supervisory authorities and the "one stop shop"
  10. 10Definitions
    1. Consent
    2. Controller
    3. Data subject
    4. Direct marketing
    5. FOI public authority
    6. Manual unstructured processing of personal data
    7. Processor
    8. Personal data
    9. Public authority and public body
    10. Recipient
    11. Special categories of personal data
    12. Processing
    13. Profiling
    14. Filing system
    15. Fundamental right or fundamental freedom
    16. Representative
    17. Pseudonymisation
    18. Public authority and public body
    19. Main establishment
    20. Binding corporate rules
    21. Third country
  11. 11Data protection principles
    1. First data protection principle: lawfulness, fairness and transparency
    2. Fair processing: information notices
    3. Data collected from the data subject
    4. Data collected from third parties
    5. Lawful processing
    6. Consent rules
    7. Children and consent
    8. Other grounds for data processing
    9. Vital interests condition
    10. Legitimate interests condition
    11. Direct marketing and draft E-Privacy Regulation
    12. Progress on the draft e-Privacy Regulation
    13. Cookies and similar technologies
    14. Public authorities and the UK GDPR
    15. Special categories of personal data
    16. Criminal convictions and offences data
    17. Second data protection principle: purpose limitation
    18. Third data protection principle: data minimisation
    19. Fourth data protection principle: accuracy
    20. Fifth data protection principle: storage limitation
    21. Sixth data protection principle: integrity and confidentiality
    22. Accountability
  12. 12Obligations on controllers
    1. Legal basis for processing
    2. Processors
    3. Accountability
    4. Data protection by design and by default
    5. Documentation (records of processing activities)
    6. Data protection impact assessments
    7. High risk to data subjects' right and freedoms
    8. Co-operation with the ICO
    9. Appointment of a data protection officer
    10. Joint controllers
    11. Designation of representatives of controllers or processors not established in the UK
  13. 13Rights of the data subject
    1. Information notices
    2. Subject access requests
    3. The right to erasure and the right to be forgotten
    4. Data portability
    5. Automated decision making (including profiling)
    6. Right to object
    7. Right to restriction on processing
    8. Right to rectification
    9. Notification obligation regarding rectification or erasure or restriction of processing
    10. Can controllers charge a fee?
    11. Special categories of personal data
  14. 14Transfers of personal data to third countries or international organisations
    1. Legacy data and personal data transfers outside of the UK
    2. Transfers under UK adequacy regulations (UK GDPR)
    3. Transfers from the UK to the United States (UK GDPR)
    4. Transfers under an EU-UK adequacy decision (EU GDPR)
    5. Transfers subject to appropriate safeguards (UK GDPR)
    6. UK Binding corporate rules (UK GDPR)
    7. Standard contractual clauses (SCCs)
    8. Impact of ECJ ruling in Schrems II: SCCs valid but EU-US Privacy Shield invalid
    9. EDPB Recommendations 02/2020 on supplementary safeguards
    10. European Commission SCCs (EU GDPR)
    11. ICO international data transfer agreement (IDTA) and Addendum to EU Commission SCCs (Addendum)
    12. Approved codes of conduct and approved certification mechanisms
    13. Derogations for specific situations
    14. Further reading on personal data transfers to and from third countries
  15. 15Data security and personal data breaches
    1. Obligation to have appropriate data security in place
    2. Assessing the appropriate level of risk and appropriate security
    3. Notification of personal data breaches to the ICO
    4. Notification of personal data breaches to individuals
    5. Data security and the public sector
    6. PECR: Communications service providers
  16. 16Exemptions
  17. 17Article 23 exemptions
    1. DPA 2018 exemptions: Section 15 and Schedules 2, 3 and 4
  18. 18Provisions relating to specific processing activities
    1. Freedom of expression and information: the "special purposes" of journalistic, academic, artistic and literary purposes
    2. Public access to official documents: Freedom of Information Act 2000 and Environmental Information Regulations 2004
    3. Safeguarding national security and defence
    4. Archiving and scientific or historical research and statistical purposes
  19. 19Information Commissioner
  20. 20Enforcement, sanctions and remedies
    1. Individuals' rights
    2. Information Commissioner's powers of enforcement and sanctions
  21. 21Comment