What are the lawful basis for processing personal data?

Under the Data Protection Act 2018 (which implements the General Data Protection Regulation 2016) (UK GDPR) if a business (i.e., a controller) wants to process personal data about a person (e.g., customer, client, prospective client, supplier or employee etc) it can only do so if it can satisfy at least one of the following six […]

What information must go in processor contracts?

When a controller uses a third party to process personal data on its behalf – known as a processor – certain provisions must be included in a written contract in order to comply with the Data Protection Act 2018 (UK GDPR). If you, as a controller, use a processor to process personal data on your behalf (which […]

What information does a privacy notice need to contain?

Under the UK’s Data Protection Act 2018 (UK GDPR), privacy notices need to contain a lot more information than they used to because the UK GDPR is very prescriptive about what information needs to be given to individuals. Under the UK GDPR, personal data must be ‘processed lawfully, fairly and in a transparent manner in […]