The rules in plain English
In the UK, personal data is governed by the UK GDPR and the Data Protection Act 2018, and electronic marketing and cookies by the Privacy and Electronic Communications Regulations (PECR). The regulator is the Information Commissioner’s Office (ICO).
A practical checklist
- A clear privacy notice saying what you collect, why, who receives it and how long you keep it
- A lawful basis for each use of personal data, such as consent, contract or legitimate interests
- A cookie banner that sets non-essential cookies only after consent
- Forms that collect only the data you need, with a link to your privacy notice
- A process for access, correction and deletion requests, which you normally answer within one month
- Written agreements with suppliers who process data for you
Security and breaches
Use HTTPS, keep software updated, limit who can see personal data and keep audit logs. If a personal data breach is likely to put people at risk, you generally need to report it to the ICO within 72 hours of becoming aware of it.
Registration and fees
Many organisations that process personal data must pay a data protection fee to the ICO unless an exemption applies, so check the ICO’s self-assessment before launch.
This article is general information, not legal advice. For decisions about your own business, ask a qualified adviser.
Globalsoft TeamGlobalsoft · Erbil · Istanbul