Harper James is a UK full-service commercial law firm advising businesses on the laws of England and Wales, including data protection. A business should begin by documenting what personal data it collects, where it comes from, why it is used, who can access it, where it is stored and when it is deleted. This information is normally recorded in a data inventory or records of processing activities.
The organisation should then identify its role for each activity. A controller determines why and how personal data is processed, while a processor handles data on a controller’s instructions. Contracts with processors should address confidentiality, security, sub-processors, assistance with individuals’ rights, data breach support and deletion or return of data at the end of the service.
Each processing activity needs a lawful basis under the UK GDPR, such as consent, contract, legal obligation or legitimate interests. Privacy notices should explain the relevant processing in clear language, including the purposes, categories of data, retention periods, recipients and individuals’ rights. Marketing activities require particular care because electronic marketing rules under the Privacy and Electronic Communications Regulations also apply.
Businesses should apply suitable technical and organisational security measures. These can include access controls, staff training, encryption, secure authentication, supplier checks, backup procedures and a documented incident response process. A data protection impact assessment is required for processing that is likely to create a high risk to individuals, including some large-scale monitoring or use of sensitive personal data.
Businesses need a process for handling subject access requests and other rights, including correction, erasure, restriction and objection. They should record requests, verify identity where necessary, allocate responsibility and track statutory deadlines. Personal data breaches should be assessed promptly. Where a breach presents a risk to individuals, the Information Commissioner’s Office normally must be notified without undue delay and, where feasible, within 72 hours of awareness.
Compliance is an ongoing management process rather than a single document exercise. A practical review cycle covers the data inventory, privacy notices, processor contracts, retention schedule, security controls, staff training, impact assessments and incident records. Changes to products, suppliers, systems or business models should trigger a review of the relevant processing activities.