![\"Typing](\"https:\/\/www.highspeedtraining.co.uk\/hub\/wp-content\/uploads\/2026\/07\/data-1.jpg\")
<\/figure><\/div>\n\n\nThe Act reflects the risks that technological advancements bring by helping people have more control over their personal data, especially as this kind of data is processed now more than ever. Moreover, in 2016 the European Union (EU) introduced the General Data Protection Regulation (GDPR) which necessitated new data privacy and security laws for organisations around the world. It imposed an obligation on organisations, both inside and outside of the EU, to adhere to seven protection and accountability principles. The UK is no longer part of the EU and so the Act, alongside the UK General Data Protection Regulation<\/a> (UK GDPR), reflects an adaptation of EU guidelines to suit data processing in the UK.\u00a0<\/p>\n\n\n\n Under the Act, data subjects have rights regarding their personal information. These rights are:<\/p>\n\n\n\n Failure to comply with data protection legislation can result in hefty fines as well as a damaged reputation. Our Data Protection & UK GDPR Training<\/a> is designed to help businesses comply with the essential principles of the Act, protecting customers and keeping businesses legally compliant.<\/p><\/div>\n\n\n\n Any business or person who uses or holds an individual’s personal data within the EU or UK must adhere to the Data Protection Act 2018. Breaching the Act is a criminal offence and can result in severe penalties.<\/p>\n\n\n\n There are seven principles at the core of the Act. These principles are:<\/p>\n\n\n\n All personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject. Lawfulness refers to the processing of personal data by a data controller which must have a legal basis under the UK GDPR and comply with requirements of the UK GDPR and the Act. The processing of data must not involve any otherwise unlawful processing or use of personal data. Fairness refers to the processing of any personal data and necessitates that it be fair in order to avoid processing being unduly detrimental, unexpected, misleading or deceptive. Transparency ensures that personal data processing is clear and transparent to individuals and regulators. Data controllers must inform individuals about how their personal data will be processed in an accessible and easily understandable manner.\u00a0<\/span><\/p>\n The ICO summarises the <\/span>first principle<\/span><\/a> as follows:<\/span><\/p>\n The UK GDPR defines a controller as \u2018the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.\u2019 The ICO states that a controller can be a company or other legal entity (such as an incorporated partnership, incorporated association or public authority), or an individual (such as a sole trader, partner in an unincorporated partnership, or self-employed professional, e.g. a barrister).<\/p>\n<\/div>\n <\/div>\n Personal data must only be collected for the \u2018specified, explicit and legitimate purposes\u2019 determined at the time of collection. Personal data must not be further processed in a manner that is incompatible with those purposes. However, where there are sufficient safeguards in place, data controllers may undertake further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes if those purposes are not considered incompatible with the initial purposes.\u00a0<\/span><\/p>\n This principle seeks to ensure that controllers are clear and open about the proposed processing of personal data from the onset and that the purposes of data processing are in line with an individual\u2019s reasonable expectations.\u00a0<\/span><\/p>\n The ICO summarises the <\/span>second principle<\/span><\/a> as follows:\u00a0<\/span><\/p>\n Data minimisation mandates that controllers only collect and process personal data that is adequate, relevant and limited to what is necessary for the purpose for which it is being processed. Data controllers should collect the minimum amount of data they require for their intended processing purposes and they should never collect unnecessary personal data.\u00a0<\/span><\/p>\n The data minimisation principle supports data protection by limiting the amount of personal data which could be lost or stolen. This assists in ensuring the integrity and confidentiality of personal data and makes it easier for organisations to ensure that the data they hold is accurate and up-to-date.\u00a0<\/span><\/p>\n The ICO summarises the <\/span>third principle<\/span><\/a> as follows:\u00a0<\/span><\/p>\n The accuracy principle mandates that all personal data collected, stored or otherwise processed by a controller must be accurate and where necessary, kept up-to-date. Data controllers should take all reasonable steps to ensure that any inaccurate personal data is erased or rectified as soon as possible.\u00a0<\/span><\/p>\n All reasonable steps must be taken to correct any inaccuracies in a timely manner. As such, controllers must have clear procedures in place for correcting or erasing any inaccurate data that they may hold.\u00a0<\/span><\/p>\n The ICO summarises the <\/span>fourth principle<\/span><\/a> as follows:<\/span><\/p>\n Controllers must hold personal data for no longer than is necessary. Personal data which permits the identification of individuals must not be held longer than necessary for the purposes for which the personal data is being processed. Personal data may be stored for a longer period where it is being processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with UK GDPR. This data must only be held for as long as there are robust technical and organisational measures to safeguard the rights and freedoms of the individual.\u00a0<\/span><\/p>\n Subsequently, controllers should generally delete personal data as soon as it ceases to be necessary for the purpose for which it was originally collected. It is therefore recommended that time limits are established by the controller for the erasure or periodic review of personal data. In line with the transparency principle, controllers should ensure that individuals are aware of retention periods or how these periods are calculated. Controllers who retain personal data in an offline manner, such as hard copy files, regardless of whether the digital copy has been deleted, must still have justification for retaining personal data in this form and respond to data subject requests.\u00a0<\/span><\/p>\n The ICO summariseS the <\/span>fifth principle<\/span><\/a> as follows:<\/span><\/p>\n The integrity and confidentiality principle, also known as the security principle, mandates that controllers only process personal data in a manner that ensures appropriate levels of security and confidentiality. This includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. Controllers must utilise appropriate technical or organisational measures to support this. Controllers must ensure that their security measures effectively protect against accidental or deliberate harm, loss, or dissemination of the personal data that they process. These measures must include cybersecurity measures and physical and organisational security measures. Organisations must routinely check that these measures are up-to-date and effective.\u00a0<\/span><\/p>\n As technological threats are constantly evolving, organisations should consider a range of security options and should ensure their security measures are also adapting to meet modern challenges.\u00a0<\/span><\/p>\n The ICO summarises the <\/span>sixth principle<\/span><\/a> as follows:<\/span><\/p>\n The accountability principle specifically states that controllers are responsible for, and must be able to demonstrate compliance with, the other principles of data protection. Controllers must ensure that they comply with all the principles of data protection and that they have appropriate measures and records in place to demonstrate compliance. Compliance with the other principles of data protection will assist in accountability as well as adopting additional measures such as creating internal policies, following codes of conduct or certification schemes, recording and reporting personal data breaches and implementing appropriate privacy policies and notices.<\/span><\/p>\n Accountability obligations are ever evolving and controllers should continually review and update their accountability measures.\u00a0<\/span><\/p>\n The ICO summarises the <\/span>seventh principle<\/span><\/a> as follows:<\/span><\/p>\n The Data (Use and Access) Act 2025<\/a> (DUAA) received royal assent in June 2025. It seeks to modernise how data is used, shared and protected across the UK. Alongside a wide range of reforms, the Act makes important changes to UK data protection and privacy laws. You can read our article on the DUAA and gain a more detailed understanding of the Act here<\/a>.\u00a0<\/p>\n\n\n The ICO notes that changes made by the act may change elements of the Data Protection Act 2018. That being said, the DUAA does not replace UK GDPR or the Data Protection Act 2018. Instead it makes amendments and introduces changes in order to promote innovation and economic growth as well as to make things easier for organisations. You can find the ICO\u2019s comprehensive overview of these changes, in the same order and headings as the DUAA, here<\/a>.\u00a0<\/p>\n\n\n\n It\u2019s worth noting that the ICO overview is aimed at experts such as data protection officers and people with specific data protection responsibilities. The overview has particular focus on what has changed <\/em>rather than being an explanation about data protection law. As such, the guidance should be read by people who already understand the current law. The ICO has a more brief overview of the changes for organisations here<\/a>.\u00a0<\/p>\n\n\n\n Robust data protection measures are vital to protecting personal data. People must be able to trust their personal data is being handled safely and in compliance with the law. Organisations that fail to adhere to the tenets of the Data Protection Act 2018 or the Data (Use and Access) Act 2025 can unnecessarily put people at risk of harm and face severe penalties.<\/em><\/p>\n\n\n\n The Data Protection Act 2018 is a key piece of legislation in the UK that governs data protection. Learn more about its core principles here.<\/p>\n","protected":false},"author":72,"featured_media":83122,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[3386,68],"class_list":["post-123","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-business","tag-data-protection","tag-financial"],"acf":{"schema_disabled":false,"schema_properties_FAQPage_question_answer":null,"schema_properties_HowTo_howto_tools":null,"schema_properties_HowTo_howto_supplies":null,"schema_properties_HowTo_howto_steps":null,"schema_properties_WebPage_cssSelector":null,"schema_sameAs_repeater":null,"schema_custom_json_repeater":null,"schema_custom_json_override":false},"hub":{"article_type":"Article","read_time":"5","enable_quiz":false,"quiz_id":null,"quiz_heading":"","quiz_subtext":"","quiz_markup":"","enable_advert":true,"advert":{"id":27257,"url":"https:\/\/www.highspeedtraining.co.uk\/courses\/business-essentials\/data-protection-course\/","desktop_src":"https:\/\/www.highspeedtraining.co.uk\/hub\/wp-content\/uploads\/2018\/03\/HST_Hub-Advert_DPOTC_GDPR.jpg","mobile_src":"https:\/\/www.highspeedtraining.co.uk\/hub\/wp-content\/uploads\/2018\/03\/HST_Hub-Advert_DPOTC_GDPR_mobile-A.jpg","alt":""},"author":{"id":72,"display_name":"Rachel Gordon","slug":"rachelgordon","description":"Rachel is a Junior Copywriter at High Speed Training with extensive experience in the education and independent hospitality sector. Having worked with students to improve their Maths and English skills, Rachel has an in-depth understanding of different educational needs. She has also worked in the independent hospitality industry, working to advocate for and raise awareness of the independent food and drink businesses at the heart of local communities. Rachel is passionate about providing people with useful information to support their personal and professional development.","active":true,"circle_image":"https:\/\/www.highspeedtraining.co.uk\/hub\/wp-content\/uploads\/2024\/10\/rachel-hub-colour.png","thumb_image":"https:\/\/www.highspeedtraining.co.uk\/hub\/wp-content\/uploads\/2024\/10\/rachel-bw.png","favourite_post":null}},"yoast_head":"\n\n
![\"Expert](\"https:\/\/www.highspeedtraining.co.uk\/hub\/wp-content\/plugins\/hub-custom-blocks-plugin\/expert-tip-icon.png\"){kind=icon}
<\/div>Looking for More?<\/h3><\/div><\/div>
Who Does the Data Protection Act Apply to?\u00a0<\/h4>\n\n\n\n
\n\n\n\nCore Principles of the Data Protection Act<\/h2>\n\n\n\n
\n Lawfulness, Fairness, Transparency
![\"drop](\"https:\/\/www.highspeedtraining.co.uk\/hub\/wp-content\/uploads\/2015\/09\/down53.png\")
\n <\/h3>\n \n
\n Purpose Limitation
\n <\/h3>\n \n
\n Data Minimisation
\n <\/h3>\n \n
\n
\n Accuracy
\n <\/h3>\n \n
\n Storage Limitation
\n <\/h3>\n \n
\n Integrity and Confidentiality (Security)
\n <\/h3>\n \n
\n Accountability
\n <\/h3>\n \n
Data (Use and Access) Act 2025<\/h4>\n\n\n\n
![\"Pile](\"https:\/\/www.highspeedtraining.co.uk\/hub\/wp-content\/uploads\/2026\/07\/data-2.jpg\")
<\/figure><\/div>\n\n\n
\n\n\n\n
\n\n\n\nFurther Resources:<\/h3>\n\n\n\n
\n