Processes personal data, in the United Kingdom

Consumer Credit Act 1974 (c. 39), ss. 158 and 159 · Read the law's page

• If you are a credit reference agency, give a consumer that asks in writing, supplies particulars enabling you to identify the file and pays the fee, a copy of the file you keep on that consumer within the prescribed period, in plain English (section 158(1) and (5)).
• If you are a credit reference agency, give the consumer, with the copy of the file, a statement in the prescribed form of the consumer's rights under section 159 (section 158(2)).
• If you are a credit reference agency and keep no file relating to the consumer, give the consumer notice of that fact (section 158(3)).
• If you are a credit reference agency and an individual who considers that an entry in the file is incorrect and likely to prejudice the individual gives you notice, inform the individual within 28 days that you have removed the entry, amended it or taken no action (section 159(1) and (2)).
• If you are a credit reference agency and the objector serves a further notice, add to the file an accompanying notice of correction of not more than 200 words and include a copy of it when furnishing information based on that entry, or tell the objector within 28 days that you intend to comply or apply to the relevant authority (section 159(3) to (5)).

Gender Recognition Act 2004 (c. 7), s. 22 · Read the law's page

• Do not disclose to any other person information that relates to a person's application for gender recognition, or that concerns their gender before it became the acquired gender, if you acquired it as an employer or prospective employer of that person or in the course of conducting business or supplying professional services, unless an exception in section 22(4) of the Gender Recognition Act 2004 applies.
• Treat a disclosure as lawful without the person's agreement only where a section 22(4) exception covers it, such as a disclosure that does not enable the person to be identified, a disclosure in accordance with an order of a court or tribunal, or a disclosure for the purpose of preventing or investigating crime.

Consumer Rights Act 2015, c. 15, s. 46 · Read the law's page

• This binds a trader that supplies digital content to a consumer under a contract; a trader acts for purposes relating to its trade, business, craft or profession, and a consumer is an individual acting wholly or mainly outside them (sections 2(2), 2(3) and 46(1)).
• If your digital content damages the consumer's device or other digital content, and the damage would not have occurred had you exercised reasonable care and skill, repair the damage within a reasonable time and without significant inconvenience to the consumer, bearing the necessary costs, or compensate the consumer with an appropriate payment (section 46(1) to (3)).
• Pay any compensation without undue delay and within 14 days of agreeing that the consumer is entitled to it, and charge the consumer no fee for the payment (section 46(5) and (6)).

Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480), regs. 2-3; Data Protection Act 2018, ss. 137, 158 · Read the law's page

• Pay the annual data protection charge to the Information Commission within the first 21 days of each 12-month charge period, unless all of the personal data processing you do is exempt processing, under regulation 2(2) of the Data Protection (Charges and Information) Regulations 2018.
• Within the same 21 days, give the Information Commission your name and address, whether you have 10 or fewer, up to 250, or more than 250 members of staff, whether your turnover is up to £632,000, up to £36 million or more (a public authority gives no turnover band), and whether you are a public authority, under regulation 2(3).
• Pay £52 if you are a micro organisation (turnover of £632,000 or less, 10 or fewer members of staff, a charity or a small occupational pension scheme), £78 if you are a small or medium organisation (turnover of £36 million or less, or 250 or fewer members of staff) and £3,763 if you are a large organisation, each reduced by £5.00 when you pay by direct debit, under regulation 3.

Data Protection Act 2018 (c. 12), ss. 171 and 172 · Read the law's page

• Do not knowingly or recklessly re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data (section 171(1)).
• Do not knowingly or recklessly process personal data that is information that has been re-identified, without the consent of the controller responsible for de-identifying it, in circumstances in which the re-identification was an offence under section 171(1) (section 171(5)).
• To rely on the effectiveness testing defence for re-identifying, act with a view to testing the effectiveness of the de-identification, without intending to cause or threaten damage or distress, in the reasonable belief that re-identifying was justified in the public interest, and notify the Commission or the controller without undue delay and, where feasible, within 72 hours of becoming aware of it (section 171(4)(d) and section 172).

Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 · Read the law's page

• Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
• Do not rely on the recognised legitimate interests basis if you are a public authority exercising your own core functions; a necessity test still applies even though no balancing test is required.for a public body

UK GDPR, Art. 9; Data Protection Act 2018, Sch. 1 · Read the law's page

• Obtain explicit consent, or establish another UK GDPR Article 9(2) or Data Protection Act 2018 Schedule 1 basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
• Treat biometric data as covered from the moment you collect it once you have determined a purpose of unique identification, not only from the point you actually perform identification or verification, per the ICO's Biometric recognition guidance.

UK GDPR, Arts. 12-21; Data Protection Act 2018, s. 164A · Read the law's page

• Confirm to a person in the United Kingdom, when they ask, whether you process their personal data, and give them access to it and the information listed in UK GDPR Article 15(1), on the basis of a reasonable and proportionate search.
• Rectify a person's inaccurate personal data and complete incomplete data when they ask, under UK GDPR Article 16.
• Erase a person's personal data without undue delay when they ask and a ground in UK GDPR Article 17(1) applies, unless an exception in Article 17(3) covers the processing.
• Restrict the processing of a person's personal data when they ask and a case in UK GDPR Article 18(1) applies.
• Give a person the personal data they provided to you in a structured, commonly used and machine-readable format, and transmit it directly to another controller where technically feasible, where the processing rests on consent or a contract and is automated, under UK GDPR Article 20.
• Stop processing a person's personal data for direct marketing when they object, and stop processing based on a public task, recognised legitimate interests or legitimate interests unless you demonstrate compelling legitimate grounds, under UK GDPR Article 21.
• Answer a rights request before the end of one month beginning with the relevant time, and extend that period by up to two further months only by notice, given within that first month, that states the reasons, under UK GDPR Articles 12 and 12A.
• Tell the person, without undue delay and before the end of the applicable time period, your reasons for not acting on a request and their right to complain to you under section 164A of the Data Protection Act 2018, to complain to the Information Commission, and to seek a judicial remedy, under UK GDPR Article 12(4).
• Acknowledge a data subject's complaint to you within 30 days of receiving it, provide a way to complain such as an electronic form, respond to the complaint without undue delay and tell the complainant the outcome, under Data Protection Act 2018 section 164A.

UK GDPR, Arts. 33-34; Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025 · Read the law's page

• Notify the Information Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in the United Kingdom, unless the breach is unlikely to risk their rights and freedoms.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms, and if you are a telecoms or ISP-type provider, notify a PECR breach to the Information Commission within 72 hours.

UK GDPR, Arts. 4(1) and 11 · Read the law's page

• Where you can demonstrate that you are not in a position to identify the data subject because the purposes of your processing do not or no longer require identification, inform the data subject accordingly, if possible (Article 11(2)).
• Where Article 11(2) applies, give effect to a data subject's rights under Articles 15 to 20 once the data subject provides additional information enabling identification (Article 11(2)).

UK GDPR, Arts. 44A-50, as amended by the Data (Use and Access) Act 2025 · Read the law's page

• Before moving personal data of a person in the United Kingdom outside the UK, either rely on a UK adequacy regulation, put appropriate safeguards in place such as the ICO's International Data Transfer Agreement or Addendum, or rely on a narrow Article 49 derogation, under UK GDPR Article 44A.

UK GDPR, Arts. 82-83; Data Protection Act 2018 §169 · Read the law's page

• Expect the Information Commission to have jurisdiction and fining power, up to the higher of GBP 17,500,000 or 4 percent of global annual turnover, over your processing of personal data of a person in the United Kingdom.
• Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor, under UK GDPR Article 82, but expect a UK representative claim to require proof of unlawful use and resulting damage for each individual claimant, not a bare loss-of-control theory, per Lloyd v Google.