ICO Definition

View the related checklists about ICO

Planning a digital marketing campaign—checklist

Planning a digital marketing campaign—checklist This Checklist is for use when planning a digital marketing campaign. The focus is on marketing-specific requirements and the Checklist does not consider general issues in relation to transactional activity (eg contract formation, distance selling). It covers media selection, territorial targeting, agency contracts, data protection, advertising compliance, user-generated content, influencer engagement, prize and price promotions, and behavioural advertising. It also considers compliance with legislative and self-regulatory regime in the UK, including the unfair commercial practices provisions of the Digital Markets, Competition and Consumers Act 2024 (DMCCA 2024) and the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (CAP Code). Digital marketing can reach consumers at home, at work and, through their mobiles, tablets and video game consoles, virtually everywhere else. Alongside unrivalled potential audience numbers, it offers brands the opportunity to target individuals on the basis of their specific interests, locations or habits. It is no surprise, then, that brands are diverting more and more of their marketing spend from traditional media to...

Privacy notices—what information to include—checklist

Privacy notices—what information to include—checklist In brief In summary, UK data protection law is intended to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly. To help ensure that, the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) regime imposes a large number of obligations on those ‘processing’ personal data, and on the controllers of such processing, when they are in the scope of the UK GDPR regime. The UK GDPR also grants rights to those whose personal data is processed (the ‘data subjects’). ‘Processing’ includes doing almost anything with personal data, including storing, sharing, deleting or using it. It is virtually impossible to operate a business or other organisation without processing personal data. Among other things, the ‘controllers’ of personal data processing are required to provide certain information to data subjects, such as to ensure they know why their personal data is being collected, how it is being used, who it is being shared with, and their own...

View the related flowcharts about ICO

Evaluating an objection to processing request—flowchart

Evaluating an objection to processing request—flowchart This document reflects the UK GDPR regime. References and links to the GDPR refer to the UK GDPR (Assimilated Regulation (EU) 2016/679) unless expressly stated otherwise. The UK General Data Protection Regulation (UK GDPR) provides a number of rights for data subjects, including providing a right to object. Data subjects can make a request to an organisation to exercise their right to object to processing at any time. This is not, however, an absolute right to object—it only applies in specific circumstances. There are strict time limits for complying with requests made. See Practice Notes: • Data subject rights—objection to processing • How to handle data subject requests This Flowchart maps out a process for evaluating a data subject request under the right to object that your organisation receives under the UK GDPR. It reflects the requirements in the UK GDPR and the Data Protection Act 2018 (DPA 2018) together with guidance issued by the Information Commissioner’s Office (ICO). It should be...

Data protection impact assessments—flowchart

Data protection impact assessments—flowchart This flowchart illustrates how to establish whether or not you need to conduct a data protection impact assessment (DPIA) in relation to a particular project, and how to conduct one if it is required. See also Precedents: Data protection impact assessment—DPIA and Data protection impact assessment—DPIA—short form, which is based on a template issued by the Information Commissioner’s Office (ICO). The ICO’s Data Protection Impact Assessments guidance sets out seven steps to conducting a DPIA, whereas the ICO’s Data protection impact assessments guidance sets out a nine-stage process, as shown above. The two processes are broadly the same but the latter is more intuitive and is adopted in this flowchart. Note 1: Identify the need for a DPIA If you have a data protection officer (DPO), ask them for advice. For further information, see Practice Note: How to complete a data protection impact assessment—DPIA—Who should conduct the DPIA? A DPIA is compulsory in the case of: • a systematic and extensive evaluation of personal aspects...

View the related practice notes about ICO

Digital Planning in England

Digital Planning in England Note that this Practice Note was last updated in April 2025. Introduction In October 2023, the Levelling-up and Regeneration Act 2023 (LURA 2023) gained Royal Assent and became the first legislation to seek to define data standards and data software. Since then, the intersection of planning and digitisation has only increased in scale and scope. In the last four months, the government has published the ‘AI Opportunities Action Plan’, has issued a policy statement on the Data Use and Access Bill, while the forthcoming Cyber Security and Resilience Bill will have digital implications for energy and transport networks and smart city initiatives. The inexorable progress towards automation and digitisation has many benefits: diverting human resources to where they are most useful, extending the reach of the planning process and improving participation, and helping to understand and mitigate environmental issues. It also challenges existing norms on issues including equalities, human rights, public sector decision-making and probity in planning. Given the scale and scope of coming changes, it...

Right to work checks: when and why

Right to work checks: when and why This Practice Note looks at why employers need to carry out ‘right to work’ checks and when such checks should be made. Why should employers conduct right to work checks? Illegal employment It is unlawful to employ an adult who is subject to immigration control who has: • not been granted permission to enter or stay in the UK, or • permission that is invalid, expired or otherwise ceased to have effect (eg cancelled or curtailed) or which is subject to a condition preventing him from accepting employment An infringement will arise, even if the employer has no knowledge of the illegality. Therefore checking whether a person is entitled to work in the UK is necessary in order to avoid inadvertently breaking the law. Some assurance of this nature will arise, to the extent the check is reliable, even if the check does not comply with formal requirements. For guidance on the civil penalty regime, see Practice Note: Illegal workers—civil...

View the related precedents about ICO

EU GDPR—standard contractual clauses (SCCs) for compliance with Article 28(3) EU GDPR by Danish supervisory authority

EU GDPR—standard contractual clauses (SCCs) for compliance with Article 28(3) EU GDPR by Danish supervisory authority This is a set of Standard Contractual Clauses (SCCs) for compliance with Article 28(3) of the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR), governing relationships between controllers and processors and published by the Danish data protection supervisory authority (the Danish SCCs). It was published following an opinion by the European Data Protection Board (EDPB). The Danish SCCs should not be confused with SCCs relating to international personal data transfers under Chapter V of the EU GDPR. Access the Danish SCCs Click the link below to download the agreement from the EDPB’s website: Standard Contractual Clauses for compliance with Article 28(3) of the EU GDPR published by the Danish supervisory authority (the Danish SCCs) Background As detailed in Practice Note: Supply chains under EU GDPR—arrangements between controllers and processors, Article 28(3) of the EU GDPR requires that controllers and processors put in place a contract which contains certain minimum terms (unless the...

Data sharing decision form

Data sharing decision form For use by the organisation taking the decision to share data. 1 Request details Name of organisation receiving request to share data [Insert name of organisation receiving the request for data sharing] Name of organisation requesting data [Insert name of organisation requesting data] Name and position of person requesting data [Insert name and position of person requesting data] Date request received [Insert date you received the request] 2 Description of data sharing Description of data requested [Insert description of the data you are seeking access to] Data controller relationship ☐ Joint☐ Separate Will we have a data sharing agreement in place? ☐ Yes☐ No[If no, explain why not] 3 Lawful processing Purpose of sharing [Insert description of why the data will be shared] Lawful basis of sharing [Insert relevant lawful basis for sharing, eg contractual performance, consent, legitimate interests] Why is sharing necessary? [Insert description of why the data sharing is necessary for the purposes identified above] Are special conditions met for...

View the related q&as about ICO

If a data controller shares personal data with another data controller based outside the EEA, and in doing so exports that personal data outside of the EEA using one of the permitted data export exceptions or adequacy solutions under Schedule 4 of the Data Protection Act 1998 (DPA 1998), does the transferor data controller retain any liability for the processing of that personal data by the transferee controller under the DPA 1998?

If a data controller shares personal data with another data controller based outside the EEA, and in doing so exports that personal data outside of the EEA using one of the permitted data export exceptions or adequacy solutions under Schedule 4 of the Data Protection Act 1998 (DPA 1998), does the transferor data controller retain any liability for the processing of that personal data by the transferee controller under the DPA 1998? For the purposes of this Q&A we have focused solely on the law under the UK’s Data Protection Act 1998 (DPA 1998) as regulated by the Information Commissioner’s Office (ICO). Please note that: • the General Data Protection Regulation (GDPR) will introduce substantial amendments to data protection law and will replace the current DPA 1998 and the current Directive 95/46/EC (the Data Protection Directive). The GDPR will be directly applicable and fully enforceable in all EU Member States from 25 May 2018. For further information, see Practice Note: Introduction to the EU GDPR and...

What is 'personal data' for the purposes of the Data Protection Act 1998?

What is 'personal data' for the purposes of the Data Protection Act 1998? For the purposes of the Data Protection Act 1998 (DPA 1998), 'personal data' is defined as: 'data which relate to a living individual who can be identified— (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual' This definition refers to several key terms which are further defined in DPA 1998. The term 'data' is defined to include information which: '(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose (b) is recorded with the intention that it should be processed by means of such equipment (c) is recorded as part of a "relevant filing system" or...

View the related News about ICO

TMT weekly highlights—19 June 2025

Welcome to this week’s edition of the TMT weekly highlights: a hand-picked summary of news analysis, updates and new content from across the technology, media and telecoms sectors. These highlights focus on key topics including new technologies, software, cloud computing, internet, outsourcing, music, film & television, publishing, defamation and telecoms.

Life Sciences weekly highlights—19 June 2025

This week's edition of Life Sciences weekly highlights includes a Law360 news analysis that the Unified Patent Court ruled that Curio Bioscience's Seeker Spatial Mapping Kits infringed patents by 10x Genomics, upholding an injunction against the U.S. biotech company's rival in Germany, France and Sweden, and an MLex analysis that the European Commission is pressing ahead for August 2025 with finalising the Code of Practice for general-purpose AI (GPAI) model developers despite possible AI Act delays as well as news that the Commission has published its timeline for the implementation of the EU AI Act. Also, this week includes several important news stories in the medical devices sector: the MHRA brought into force the Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024 from 16 June marking the first major reform to post-market surveillance (PMS) legislation for medical devices in Great Britain, the UK MedTech Forum called on the MHRA for the indefinite recognition of EU CE-marked medical devices and advocated for the introduction of internationally aligned reliance...