GDPR
General Data Protection Regulation
Personal data is:
- information about a particular individual
- it doesn’t need to be ‘private’ information
- it doesn’t cover truly anonymous information
Data protection is about ensuring people can trust you to use their data fairly and responsibly. If you collect information about individuals for any reason other than your own personal, family or household purposes, you need to comply.
The UK data protection regime is set out in the DPA 2018, along with the GDPR.
GDPR provides the following rights for individuals:
- right to be informed
- right of access
- right to rectification
- right to erasure
- right to restrict processing
- right to data portability
- rights in relation to automated decision making and profiling
A controller is the person that decides how and why to collect and use the data. This will usually be an organisation, but can be an individual.
- They are the main decision makers.
A processor is a separate person or organisation who processes data on behalf of the controller and in accordance with their instructions.