Processing data fairly: what it means under UK GDPR

Fairness is half of the first data protection principle, which asks for personal data to be processed lawfully, fairly and transparently. The ICO puts it in simple terms: you should only handle personal data in ways that people reasonably expect, and not use it in ways that have unjustified adverse effects on them.

What counts as unfair

The ICO says you must not process data in a way that is unduly detrimental, unexpected or misleading to the people concerned. So an organization can fall short of fairness in three main ways: by using your data in a way that harms you without good reason, by using it for something you wouldn't have expected when you handed it over, or by misleading you about what happens to it.

Fair is separate from lawful

An organization needs a lawful basis to use your data, such as your consent or a contract with you. But the ICO is clear that if any aspect of the processing is unfair, it breaches the principle even where there is a lawful basis. Having a legal reason doesn't make every use fair.

Examples of how it plays out

You give your email to get a receipt and the company starts sharing it with advertisers without telling you. That is unexpected and probably unfair.
A website's form says it collects a phone number to confirm delivery, then the number goes to a marketing list. That is misleading.
A system makes decisions about people in a way that discriminates unjustly. The ICO's AI guidance says that processing that leads to unjust discrimination violates the fairness principle.

Fairness vs. transparency

Transparency is about telling people what you do with their data, in clear language. Fairness is about whether what you do is acceptable at all. A company can be fully open about a practice that is still unfair.

Who has to follow it

Organizations that decide how and why personal data is used (controllers) have to follow it under the UK GDPR, and the EU GDPR has a matching fairness requirement.

How to protect yourself

Read what a form says it will do with your data

Look for the reason the company gives for collecting each detail. If the reason doesn't match what you later get, that's a flag.

Ask what a company holds about you

You can make a subject access request to see your data and who it was shared with. The ICO has templates and guidance.

Object or withdraw consent

Where a company uses your data for marketing, you can tell it to stop, and it has to comply.

Complain to the ICO

If a company ignores you after you have raised it, you can take the complaint to the ICO.

Reduce where your details sit

Serus finds where your address and phone number are listed publicly and removes them, which cuts down how much of your data is out of your control.

Frequently asked

What is the difference between fair and lawful processing?

Lawful means there is a legal basis for using the data. Fair means the use is something people would reasonably expect and doesn't unjustly harm them. You need both.

Does fairness apply to AI?

Yes. The ICO says AI processing that leads to unjust discrimination between people violates the fairness principle.

Is fair processing in the GDPR?

Yes. Fairness sits in the first data protection principle in both the UK GDPR and the EU GDPR.

What happens if a company processes data unfairly?

It breaches the principle even if it has a lawful basis, and you can complain to the company and then to the ICO.

What does processing data fairly mean?