GDPR Information

What is GDPR?

GDPR is the General Data Protection Regulation.  The GDPR forms part of the data protection regime in the UK, together with the new Data Protection Act 2018 (DPA 2018). The main provisions of this apply, like the GDPR, from 25 May 2018.

What information does the GDPR apply to?

  • Personal data

    The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

    This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.

    The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.

    Personal data that has been pseudonymised – eg key-coded – can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.

  • Sensitive personal data

    The GDPR refers to sensitive personal data as “special categories of personal data”.

    The special categories specifically include genetic data, and biometric data where processed to uniquely identify an individual.

    Personal data relating to criminal convictions and offences are not included, but similar extra safeguards apply to its processing.