The GDPR has been with us now for over two years and has touched many
different areas of business. The GDPR has been retained in UK law by virtue
of the European Union (Withdrawal) Act 2018 and amended by the Data
Protection, Privacy and Electronic Communications (Amendments etc.) (EU
Exit) Regulations 2019, resulting in the UK GDPR. The UK GDPR forms part of
a broader body of legislation, including the Data Protection Act 2018 and,
often, the Privacy and Electronic Communications Regulations 2003, commonly
referred to in legal documents as “the data protection legislation”. For
many small businesses, the GDPR is the focus. The obligations and rights
contained in the GDPR remain in the UK GDPR. In fact, the UK GDPR is, in
many areas, no different at all to the EU GDPR from which it is derived,
save for some alterations to make it fit in the UK-domestic context.
Two of the “key players” in data protection law are controllers and
processors. If a data controller wishes to appoint a data processor to
process personal data on its behalf, the processing must be carried out
under a written contract.
New UK Data Processing Agreement
As we ready the rest of our data protection content for the end of the
Brexit transition period, we are now publishing our first new UK GDPR
template, designed for UK-only personal data processing.
Designed for use alongside a “master” service agreement or similar, this
document governs a data processor’s processing activities on behalf of a
data controller, as provided as part of their services. As the name
suggests, this document is designed for situations in which both the
controller and processor are UK-based, and the data processing takes place
only within the UK. This template has been designed to assist in your
compliance with the retained EU law version of the GDPR (the UK GDPR) and
the Data Protection Act 2018.
Updates to our full range of data protection content are currently in
progress and will be available very soon.
The contents of this Newsletter are for reference purposes only and do not constitute
legal advice. Independent legal advice should be sought in relation to any specific