3 - data protection

what act stipulates all the rules on data protection

DPA 2018 (Data Protection Act)

what legal responsibilities do a firm have with regards to data protection

notify the ICO that they are processing info

process personal info in line with data protection principles

who is the ICO

information commissioner’s office

what are the 6 data protection principles

processing must be lawful + fair

purposes of processing must be specific, explicit + legitimate

personal data must be adequate, relevant + not excessive

personal data must be accurate + up to date

personal data must be kept for no longer than is necessary

personal data must be processed securely

who has to register with the ICO

all entities classified as data controllers

how can the ICO enforce the rules

criminal prosecution if broken —> unlimited fines

what does UK GDPR stand for

UK General Data Protection Regulation

who does GDPR apply to

data controllers + data processors

what are the penalties available under GDPR

break a PRINCIPLE: greater of £17.5m or 4% of annual turnover

breach another provision: greater of £8.7m or 2% of annual turnover