Learning 1 – Understanding UK Data Protection Law
| Site: | MyStudentSite Moodle |
| Course: | UK Data Protection Interactive SCORM |
| Book: | Learning 1 – Understanding UK Data Protection Law |
| Printed by: | Guest user |
| Date: | Tuesday, 4 August 2026, 11:56 PM |
1. Section 1: Understanding UK data protection law
Section 1: Understanding UK data protection law
Legal foundations, key definitions and organisational roles.
Learning outcomes
By the end of this section, you should be able to:
- describe the relationship between the UK GDPR and the Data Protection Act 2018;
- explain the purpose of the Data (Use and Access) Act 2025 amendments;
- identify personal data, special category data and criminal offence data; and
- distinguish between a controller, processor and data subject.
Why this matters
Organisations use personal information to deliver services, employ staff, communicate with customers, protect people and make decisions. Poor handling can cause identity theft, discrimination, distress, financial loss, physical risk and loss of trust.
Section learning route
- Learn how the current legal framework fits together.
- Recognise the different categories of data.
- Understand who decides how data is used.
- Apply the definitions to realistic workplace examples.
Official reference points
- GOV.UK: The UK's data protection legislation
- legislation.gov.uk: Data Protection Act 2018
- legislation.gov.uk: Data (Use and Access) Act 2025
- ICO: UK GDPR guidance and resources
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.
1.1. 1.1 The current legal framework
1.1 The current legal framework
How the UK GDPR, DPA 2018, DUAA 2025 and ICO fit together.
The two main instruments
UK General Data Protection Regulation
The UK GDPR sets the main rules for processing personal data. It covers principles, lawful bases, individual rights, accountability, security, international transfers and regulatory powers.
Data Protection Act 2018
The DPA 2018 complements the UK GDPR. It contains UK-specific provisions, exemptions, rules for law-enforcement processing, rules for intelligence services and criminal offences relating to personal data.
The Data (Use and Access) Act 2025
The DUAA amended parts of the UK's data protection framework. Relevant changes now in force include a seventh Article 6 lawful basis called recognised legitimate interest, changes affecting some rights and automated decision-making provisions, and a statutory process for data protection complaints.
Who regulates the law?
The Information Commissioner's Office (ICO) is the UK's independent regulator for data protection and information rights. It publishes guidance, considers complaints, investigates organisations and can use enforcement powers.
Knowledge checkpoint
Answer each question before opening the suggested answer.
1. Which two instruments form the main foundation of everyday UK data protection compliance?
Suggested answer: The UK GDPR and the Data Protection Act 2018, read together and as amended by later legislation.
2. What is the ICO?
Suggested answer: The UK's independent regulator for data protection and information rights.
3. Why must training resources be reviewed periodically?
Suggested answer: Legislation, commencement dates, court decisions, ICO guidance and organisational processes can change.
Official reference points
- GOV.UK: The UK's data protection legislation
- legislation.gov.uk: Data Protection Act 2018
- legislation.gov.uk: Data (Use and Access) Act 2025
- ICO: UK GDPR guidance and resources
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.
1.2. 1.2 Personal data and protected categories
1.2 Personal data and protected categories
Recognising personal, special category and criminal offence data.
Personal data
Personal data is information relating to an identified or identifiable living person. A person may be identified directly, such as by name, or indirectly by combining information such as an identification number, location information, online identifier or characteristics.
| Example | Why it may be personal data |
|---|---|
| Name and home address | Directly identifies and locates a person. |
| Student or employee ID | Links to a particular individual in the organisation's systems. |
| IP address or device identifier | May identify or single out a user when combined with other information. |
| CCTV image | May show an identifiable living person. |
Special category data
This is personal data that needs additional protection because misuse may create significant risks to rights and freedoms. It includes data revealing:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- biometric data used to uniquely identify a person;
- health data; and
- data concerning a person's sex life or sexual orientation.
Criminal offence data
Personal data about criminal convictions and offences has separate legal safeguards. Organisations need an Article 6 lawful basis and must also satisfy the relevant additional rules.
Activity: Classify the records
For each item, decide whether it is ordinary personal data, special category data, criminal offence data, or not personal data in the circumstances.
- A named learner's attendance percentage.
- A staff member's medical certificate.
- A list of anonymous website totals that cannot identify or single out anyone.
- A DBS result linked to an applicant.
- A fingerprint template used to authenticate a named employee.
Open the answer guidance
- Attendance percentage: personal data.
- Medical certificate: special category health data.
- Truly anonymous totals: not personal data, provided re-identification is not reasonably possible.
- DBS result: criminal offence data and potentially other personal data.
- Fingerprint template used for unique identification: special category biometric data.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.
1.3. 1.3 Controllers, processors and processing
1.3 Controllers, processors and processing
Who is responsible for decisions about personal data?
What is processing?
Processing is a very broad term. It includes collecting, recording, organising, structuring, storing, changing, retrieving, viewing, sharing, combining, restricting, erasing and destroying personal data.
The main roles
| Role | Meaning | Example |
|---|---|---|
| Data subject | The living person the personal data relates to. | A learner, customer, applicant or employee. |
| Controller | Decides the purposes and essential means of the processing. | A college deciding why it keeps learner records and how long it retains them. |
| Processor | Processes personal data on behalf of a controller under instructions. | A cloud payroll supplier operating the system for an employer. |
Joint controllers
Two or more organisations may be joint controllers where they jointly decide purposes and means. They should transparently allocate responsibilities, while each remains responsible for compliance.
Knowledge checkpoint
Answer each question before opening the suggested answer.
1. A company decides why customer records are collected and chooses the system fields. What is its likely role?
Suggested answer: Controller, because it determines the purpose and essential means.
2. A supplier stores the records only on the company's documented instructions. What is its likely role?
Suggested answer: Processor, subject to the actual facts and contract.
3. Does simply opening or viewing a record count as processing?
Suggested answer: Yes. Retrieval and consultation are forms of processing.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.
1.4. 1.4 Applied activity: map the data flow
1.4 Applied activity: map the data flow
Use the legal definitions to analyse a realistic organisational process.
Scenario
A training provider collects applications through an online form. The data is saved in a cloud system, reviewed by admissions staff and shared with a placement employer when the applicant reaches the placement stage.
Your task
- Identify at least five items of personal data that might be collected.
- Identify any information that could be special category or criminal offence data.
- Identify the likely controller.
- Identify one possible processor.
- List each processing action taking place from collection to deletion.
- Write two questions the provider should answer before sharing data with the employer.
Open the model discussion
The provider is likely to be a controller because it decides why applicant data is collected and used. The cloud supplier may be a processor if it acts only on the provider's documented instructions.
Possible data includes name, contact details, qualifications, application statement and placement preferences. Health adjustments may be special category data. DBS information may be criminal offence data. Processing includes collection, transmission, storage, access, review, sharing, updating, restriction and deletion.
Before sharing, the provider should identify its lawful basis, confirm necessity and fairness, give suitable privacy information, minimise the data, check security and clarify the employer's role.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.