WHAT IS THE DATA PROTECTION ACT?
What Is the Data Protection Act? How Data Protection Works in the UK
Every day, businesses collect and use personal information — names, email addresses, phone numbers, payment details, website information and customer records.
But how can this information be used legally and responsibly?
In the UK, data protection is governed mainly by the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). Together, they establish rules for how organisations collect, use, store, share and protect personal information.
Whether you run an online business, manage a website, send email marketing or simply use online services, understanding data protection is important.
What Is the Data Protection Act 2018?
The Data Protection Act 2018 (DPA 2018) is UK legislation that provides a framework for protecting personal information.
It works alongside the UK GDPR and contains additional rules covering areas such as general data processing, law enforcement processing and intelligence services processing.
The basic idea is simple:
If an organisation collects or uses information about people, it must handle that information responsibly and lawfully.
The rules apply to many organisations, including businesses, charities, public bodies and other organisations that process personal information.
What Is Personal Data?
Personal data is information that relates to an identifiable living individual.
Examples can include:
- Name
- Home address
- Email address
- Telephone number
- Customer account information
- IP address and online identifiers
- Employee information
- Customer records
- Certain financial information
- Information connected to an individual's activities or behaviour
Some types of information receive stronger protection, including information concerning health, genetics, biometrics used for identification, political opinions, religious beliefs and sexual orientation.
How Does Data Protection Work?
Think of data protection as controlling the entire lifecycle of personal information.
A business might:
Collect → Use → Store → Share → Protect → Delete
For example, imagine you run an online shop.
A customer gives you their:
Name + Email + Delivery Address + Payment Information
You may need that information to process and deliver their order.
However, you shouldn't simply collect additional personal information because it might be useful someday.
You need to consider why you are collecting the information, whether you have a lawful basis for using it, how long you need it and how you will protect it.
The 7 Key Data Protection Principles
The UK GDPR contains seven key principles that sit at the heart of the data protection framework.
1. Lawfulness, Fairness and Transparency
You need a valid lawful basis for processing personal information.
You should also be open and honest with people about how and why you are using their information.
For example, if someone signs up for your newsletter, your privacy information should explain how their personal information will be used.
2. Purpose Limitation
You should collect information for specified, explicit and legitimate purposes.
In simple terms:
Know why you are collecting the data.
For example, if a customer gives you their address so you can deliver an order, that doesn't automatically mean you can use their address for an unrelated purpose.
3. Data Minimisation
Only collect information that is adequate, relevant and necessary for your purpose.
For example, if someone downloads a free business guide from your website, you may not need to ask for their home address, date of birth and telephone number.
Ask for what you actually need.
4. Accuracy
Personal information should be accurate and kept up to date when necessary.
For example, if a customer changes their address, your organisation should have a process for correcting its records.
Incorrect information can cause problems for both businesses and individuals.
5. Storage Limitation
Personal information should not be kept indefinitely without a valid reason.
Organisations should consider how long information needs to be retained and have appropriate retention practices.
The goal is simple:
Don't keep personal information longer than necessary.
6. Integrity and Confidentiality
Personal information needs appropriate security.
This can include measures such as:
- Strong passwords
- Access controls
- Encryption where appropriate
- Secure systems
- Staff training
- Software updates
- Backups
- Secure handling of customer information
The objective is to reduce the risk of unauthorised access, loss, destruction or disclosure.
7. Accountability
Organisations are responsible for complying with the principles and being able to demonstrate compliance.
This means data protection shouldn't simply be a statement on your website.
You should have appropriate processes, policies, records and security measures behind it.
What Is a Lawful Basis?
One of the most important concepts in UK data protection is the lawful basis for processing personal data.
Before processing personal information, an organisation needs an appropriate lawful basis.
The ICO currently identifies seven lawful bases:
- Consent
- Contract
- Legal obligation
- Vital interests
- Public task
- Legitimate interests
- Recognised legitimate interests
The appropriate basis depends on what you are doing and your relationship with the individual.
For example, a business may need someone's information to fulfil a contract, while another processing activity may rely on consent.
You shouldn't automatically assume that consent is required for every type of processing.
What Rights Do People Have?
Data protection law gives individuals important rights concerning their personal information.
Depending on the circumstances, these include the right to:
- Be informed about how information is used
- Access personal information
- Correct inaccurate information
- Have information erased
- Restrict certain processing
- Object to certain processing
- Receive personal information in a portable format
- Receive protections concerning certain automated decision-making and profiling
These rights aren't all absolute, and specific conditions and exceptions can apply.
What Is a Subject Access Request?
A Subject Access Request (SAR) is a request from an individual asking an organisation for access to their personal information.
For example, a customer might ask:
"What personal information do you hold about me?"
Businesses need processes for recognising, handling and responding to these requests.
The ICO provides specific guidance for organisations on subject access requests and other individual rights.
Data Protection and Websites
If you operate a website, data protection can become particularly important.
Your website might collect personal information through:
- Contact forms
- Newsletter sign-ups
- Account registrations
- Online purchases
- Booking forms
- Customer support
- Analytics
- Marketing systems
- Cookies and similar technologies
You should understand what information your website collects, why it is collected, where it goes and who has access to it.
Your privacy information should also clearly explain relevant processing to visitors.
Transparency is an important part of data protection.
Data Protection for Online Businesses
If you are building an online business, data protection should be part of your business system from the beginning.
A simple process could look like this:
Website Visitor
↓
Lead Magnet / Contact Form
↓
Email List
↓
Customer
↓
Payment & Order Information
↓
Customer Support
↓
Retention & Deletion
At every stage, ask:
What personal information am I collecting?
Why do I need it?
What is my lawful basis?
Who has access to it?
How is it protected?
How long should I keep it?
This approach helps make privacy part of your business processes rather than something you think about only after a problem occurs.
Data Protection by Design
A useful principle for modern businesses is data protection by design and by default.
This means thinking about privacy and data protection when you design a product, website, service or business process — not after everything has already been built.
For example, before launching a new website form, ask:
- What information do we really need?
- Who will receive the information?
- Where will it be stored?
- How long will we keep it?
- What security measures are needed?
- How will customers exercise their rights?
Building these questions into your planning can make compliance much easier.
What Happens If Personal Data Is Lost?
Imagine that a company loses a laptop containing customer information or discovers that an unauthorised person has accessed its customer database.
This could potentially constitute a personal data breach.
The organisation should have procedures for identifying, investigating and responding to security incidents.
The appropriate response depends on the circumstances, including the nature and severity of the breach and the risks to individuals.
This is why having a data breach response process before something happens is important.
Why Data Protection Matters for Small Businesses
Data protection isn't only an issue for large corporations.
A small business may hold:
- Customer names
- Email addresses
- Phone numbers
- Invoices
- Payment records
- Employee information
- Mailing lists
- Website enquiries
- Client notes
Even a small database contains information that should be handled responsibly.
Good data protection can also help build customer confidence.
People are more likely to trust businesses that clearly explain what happens to their information and demonstrate that they take security seriously.
A Simple Data Protection Checklist
If you run a small business or website, consider the following checklist:
✔ Know What Data You Hold
Create a basic record of the personal information your organisation collects.
✔ Know Why You Need It
Identify the purpose for each type of processing.
✔ Identify Your Lawful Basis
Make sure each relevant processing activity has an appropriate lawful basis.
✔ Create Clear Privacy Information
Explain clearly how personal information is collected and used.
✔ Collect Only What You Need
Avoid collecting unnecessary information.
✔ Protect Personal Information
Use appropriate technical and organisational security measures.
✔ Keep Information Accurate
Have a process for correcting outdated information.
✔ Review Retention
Don't keep information indefinitely without a reason.
✔ Prepare for Data Requests
Know how you will respond when someone exercises their data protection rights.
✔ Have a Breach Procedure
Know what your organisation will do if personal information is lost, stolen or accessed without authorisation.
Data Protection Is About More Than Privacy Policies
One common mistake businesses make is thinking that data protection simply means putting a privacy policy on a website.
A privacy notice is important, but compliance goes much further.
Data protection affects:
People + Processes + Technology + Security + Documentation
For example, you could have a perfectly written privacy notice but still have poor security controls or collect far more information than your business actually needs.
Effective data protection needs to be part of the way the organisation operates.
The Data Protection Act and Your Online Business
If you're building an online business, think about data protection as part of your business infrastructure.
Your system might include:
Website
↓
Privacy Information
↓
Lead Generation
↓
Email Marketing
↓
Customer Database
↓
Payment System
↓
Customer Support
↓
Data Retention & Deletion
Every stage can involve personal information.
The earlier you understand what data you collect and how you use it, the easier it becomes to build responsible processes around it.
Final Thoughts
The UK Data Protection Act 2018 and UK GDPR provide the framework for how organisations should handle personal information.
The central idea is straightforward:
Collect information responsibly.
Use it lawfully.
Be transparent.
Keep it accurate.
Protect it.
Don't keep it unnecessarily.
Respect people's rights.
For online businesses, data protection shouldn't be treated as an afterthought.
Build privacy and security into your website, marketing, customer management and business systems from the beginning.
Good data protection is not just about avoiding problems — it is about building trust with the people whose information you handle.
Important: Data protection requirements can depend on the nature of your organisation and processing activities. UK data protection guidance is also being updated following the Data (Use and Access) Act, so businesses should check current ICO guidance for their specific situation.
Comments
Post a Comment