What is data protection law?
Definition
Data protection law is the set of rules that control how organisations collect, use, store and share personal data, and that give people rights over their own information.
- Category
- Privacy
- Also called
- data protection legislation, privacy law, data privacy law
- Last updated
Data protection law sets the ground rules for anyone who handles information about identifiable people: companies, charities, public bodies. It says what they may do with that data and what they owe you in return. In the UK, the core framework is the UK GDPR, enforced by the Information Commissioner's Office (ICO), the regulator.
What the law requires
At the centre of the UK GDPR are seven principles in Article 5. Personal data has to be processed lawfully, fairly and transparently, collected for specific purposes, limited to what is necessary, kept accurate, kept no longer than needed, and held securely. The organisation in charge, called the controller, is responsible for complying and has to be able to show it.
The ICO explains that the principles don't give hard and fast rules but embody the spirit of the regime, and that they have very limited exceptions. Breaches of them fall in the highest tier of fines: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
An example
You sign up for a newsletter with your email address. Data protection law expects the company to tell you what it will do with the address, to use it for that purpose, to keep it secure and not to hold on to it forever once you've unsubscribed.
It keeps changing
The rules are updated over time. The ICO notes that its guidance is under review following changes made by the Data (Use and Access) Act, so check the ICO site for the current position.
Different countries, different laws
The UK is one example. Other countries and some US states have their own privacy laws with different scope and rights, so what you can ask for depends on where you live.
How to protect yourself
- 1
Know who holds your data
Start with the companies you deal with. Their privacy notice should tell you what they collect and why.
- 2
Write to a company to use your rights
Send your request in writing and keep a copy. If you get no answer, you can report the organisation to the ICO.
- 3
Check the law where you live
Rights vary by country and region. Look for your national regulator's guidance before you send a request.
- 4
Don't rely on the law alone
Data brokers and people-search sites may still list you. Serus finds the sites that hold your details where you live and sends removal requests for you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the main data protection law in the UK?
The UK GDPR, with the ICO as its regulator. The ICO says its guidance is under review because of changes made by the Data (Use and Access) Act.
Who enforces data protection law in the UK?
The Information Commissioner's Office (ICO) enforces the UK rules, including the fines for infringements of the data protection principles.
Does data protection law apply to small businesses?
The principles apply to organisations that handle personal data. Size doesn't take them outside the rules, though what a company has to do in practice depends on how it uses data.
Sources
Something wrong or out of date? Tell us and we'll re-check it.