Personal data is any information about a living person who can be identified from it, directly or indirectly. Customer details, staff records, CCTV images and email addresses all count. If your business decides why and how that data is used, you are its controller and these duties apply to you, whatever your size.
The Commission regulates data protection across the UK.
If you send electronic marketing or use cookies, the Privacy and Electronic Communications (EC Directive) Regulations 2003 also apply.
Pay the data protection fee
Unless all your processing is exempt, you must pay a fee to the Commission and give it your details within the first 21 days of each 12-month charge period. Your first period starts on the day you become a controller, which for most businesses is the day they first use personal data.
Your tier depends on your turnover and your average number of staff, both measured on the first day of the charge period. Staff includes employees, workers, office holders and partners.
Follow the data protection principles
Article 5 of UK GDPR sets seven principles. You are responsible for meeting them and must be able to show that you do. Personal data must be:
- used lawfully, fairly and openly
- collected for specified, explicit and legitimate purposes, and not used later in a way that is incompatible with them
- adequate, relevant and limited to what you need
- accurate and, where necessary, kept up to date
- kept in a form that identifies people for no longer than you need it
- kept secure against unauthorised use, loss, destruction or damage
The seventh principle, accountability, is the duty to prove the other six: keep records of what you do and why.
Have a lawful basis for each use
You can only use personal data if one of the lawful bases in Article 6 applies. Decide which basis covers each purpose before you start, and record your reasons.
Tell people how you use their data
When you collect personal data from someone, you must tell them at that time, in clear and plain language:
- who you are and how to contact you, and your data protection officer if you have one
- why you are using their data and your lawful basis
- the legitimate interests you rely on, if that is your basis
- who you share it with
- whether you send it outside the UK, and the safeguards that apply
- how long you will keep it, or how you decide that
- their rights, including how to withdraw consent if you rely on it
- that they can complain to you and to the Commission
- whether they have to give you the data, and what happens if they don't
- whether you make significant decisions about them solely by automated means
Most businesses publish this as a privacy notice on their website and link to it wherever they collect data.
Respond to requests and complaints
People can ask you to give them a copy of their data, correct it, erase it, restrict how you use it or move it to another provider. They can object to you using it, and must be able to stop you using it for direct marketing at any time. If you make significant decisions about them solely by automated means, you must let them challenge the decision and have a person review it.
Answer without undue delay and within one month. The month starts when you receive the request or, if later, when you receive identity information you asked for or any fee you charge. You can extend the deadline by two months if the requests are complex or numerous, but you must tell the person why before the first month ends.
Requests are free. You can charge a reasonable fee or refuse only if a request is manifestly unfounded or excessive, and you must be able to show that it is. For a request for a copy of their data, you need only make a reasonable and proportionate search.
From 19 June 2026, people can complain to you directly about how you use their data. You must make complaining easy, for example with a form they can fill in online or another way. Acknowledge each complaint within 30 days, look into it without undue delay and tell them the outcome.
Keep data secure
You must use technical and organisational security measures that match the risk, such as encryption, the ability to restore data after an incident, and regular testing of your measures.
If another business handles personal data for you, such as a payroll provider or cloud host, choose one that can keep it secure and put a written contract in place. The contract must set out the subject, length, nature and purpose of the processing, the types of data and people involved, and your rights and obligations.
Before you start any processing likely to result in a high risk to people, such as systematic monitoring of a publicly accessible area on a large scale, you must carry out a data protection impact assessment.
Keep a record of your processing
Most businesses must keep a written record of their processing. It must include your contact details, your purposes, the types of people and data, who you share data with, any transfers outside the UK and, where possible, how long you keep each type and how you protect it.
An organisation with fewer than 250 employees is exempt only if its processing is occasional, is unlikely to result in a risk to people, and does not include special category data or data about criminal convictions.
Report personal data breaches
A personal data breach is a security failure that leads to personal data being lost, destroyed, altered, disclosed or accessed without permission. Record every breach, whether or not you report it.
Appoint a data protection officer if your work requires it
You must appoint a data protection officer if you are a public authority, or if your core activities involve either regular and systematic monitoring of people on a large scale, or large-scale processing of special category data or criminal conviction data. Other businesses can choose to appoint one.
A data protection officer must have expert knowledge of data protection law. They can be a member of staff or an outside provider, and a group of companies can share one if each business can easily reach them.
Penalties and enforcement
The Commission can warn or reprimand you, order you to answer someone's request, order you to tell people about a breach, order you to change how you process data, or ban processing altogether. It can also fine you, on its own or alongside those orders.
Legal basis
Primary legislation and key regulations