UK GDPR

What does the UK GDPR cover?

The UK GDPR sets the main rules for how most organisations in the UK use personal data. It defines roles such as controller and processor, requires a lawful basis for processing, gives people rights over their information and creates duties around transparency, security, accountability and breaches.

For a small employer, it reaches beyond the HR system. Recruitment emails, payroll files, absence notes, performance records, CCTV and information held by a supplier can all fall within the same framework. The rules apply to what you do with the information throughout its life, from collection to deletion.

Use the seven principles as the operating test

The ICO's guide to the data-protection principles sets out seven linked tests: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

In practice, know why you need each category of employee information, collect only what serves that purpose, correct errors, restrict access and remove records when the reason for keeping them ends. Accountability means being able to show those decisions, not merely saying that the organisation complies.

Read it with the rest of UK data protection law

The UK GDPR is not the whole legal framework. It works alongside the Data Protection Act 2018 and later amendments. The Data (Use and Access) Act 2025 changed parts of the framework. The ICO records that all its data-protection provisions were in force by 19 June 2026, but it did not replace the UK GDPR. The EU GDPR should not be treated as the current domestic UK statute.

Other rules may also apply. PECR, for example, covers areas including electronic marketing and cookies. A useful starting record lists your processing activities, purposes, lawful bases, privacy information, rights route, processors, retention controls and breach plan, with an owner responsible for keeping each part current.