Processing Personal Data Under the UK GDPR

The GDPR has been with us now for over two years and has touched many different areas of business. The GDPR has been retained in UK law by virtue of the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, resulting in the UK GDPR. The UK GDPR forms part of a broader body of legislation, including the Data Protection Act 2018 and, often, the Privacy and Electronic Communications Regulations 2003, commonly referred to in legal documents as “the data protection legislation”. For many small businesses, the GDPR is the focus. The obligations and rights contained in the GDPR remain in the UK GDPR. In fact, the UK GDPR is, in many areas, no different at all to the EU GDPR from which it is derived, save for some alterations to make it fit in the UK-domestic context.

Two of the “key players” in data protection law are controllers and processors. If a data controller wishes to appoint a data processor to process personal data on its behalf, the processing must be carried out under a written contract.

New UK Data Processing Agreement

As we ready the rest of our data protection content for the end of the Brexit transition period, we are now publishing our first new UK GDPR template, designed for UK-only personal data processing.

Designed for use alongside a “master” service agreement or similar, this document governs a data processor’s processing activities on behalf of a data controller, as provided as part of their services. As the name suggests, this document is designed for situations in which both the controller and processor are UK-based, and the data processing takes place only within the UK. This template has been designed to assist in your compliance with the retained EU law version of the GDPR (the UK GDPR) and the Data Protection Act 2018.

Updates to our full range of data protection content are currently in progress and will be available very soon.