The UK GDPR and DPA 2018: lawful processing of personal data in employment
The UK GDPR and DPA 2018: lawful processing of personal data in employment

The following Employment practice note provides comprehensive and up to date legal information covering:

  • The UK GDPR and DPA 2018: lawful processing of personal data in employment
  • Personal data—lawful processing conditions
  • Vital interests
  • Public interest
  • When processing is ‘necessary’
  • Lawful and specific conditions for processing—consent and explicit consent
  • ICO and EDPB guidance on consent
  • Valid consent
  • Lawful condition for processing—performance of a contract with the data subject
  • Lawful condition for processing—compliance with a legal obligation
  • More...

IP COMPLETION DAY: 11pm (GMT) on 31 December 2020 marks the end of the Brexit transition/implementation period entered into following the UK’s withdrawal from the EU. At this point in time (referred to in UK law as ‘IP completion day’), key transitional arrangements come to an end and significant changes begin to take effect across the UK’s legal regime. This document contains guidance on subjects impacted by these changes. Before continuing your research, see Practice Note: Brexit and IP completion day—implications for employment lawyers.

From IP completion day (11pm on 31 December 2020), Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) is retained EU law (see Practice Note: Brexit and IP completion day—implications for employment lawyers—Retained EU law) and known as UK GDPR. Together with the parts of the Data Protection Act 2018 that relate to general personal data processing, powers of the Information Commissioner and sanctions and enforcement, as amended, this makes up the UK GDPR regime. The GDPR as it continues to apply in the EU is known as EU GDPR.

This material considers the UK GDPR regime, and legislative links are to Retained Regulation (EU) 2016/679, UK GDPR, except where expressly stated otherwise.

For a more detailed introduction to the UK GDPR generally, see Practice Notes: The UK General Data Protection Regulation (UK GDPR) and The UK General Data Protection Regulation (UK GDPR)—Navigator.

Popular documents