GDPR and Data Protection for Staff

UK data protection law is made up mainly of the UK GDPR and the Data Protection Act 2018. In day-to-day work it means handling personal information lawfully, fairly and securely, using only what you need, and knowing what to do when something goes wrong. Every member of staff who touches personal data has a part to play, not just the data protection lead.

What Data Protection Means in Day-to-Day Work

Personal data is any information that relates to an identifiable person, such as a customer, a learner or a colleague. Article 5 of the UK GDPR sets out seven principles that the Information Commissioner's Office (ICO) describes as lying at the heart of the law. Personal data must be:

• processed lawfully, fairly and in a transparent way
• collected for specified, explicit and legitimate purposes (purpose limitation)
• adequate, relevant and limited to what is necessary (data minimisation)
• accurate and, where necessary, kept up to date
• kept no longer than necessary (storage limitation)
• kept secure, using appropriate technical or organisational measures (integrity and confidentiality)

The seventh principle is accountability: the organisation must be responsible for, and able to show, that it complies with the others.

In practice, that looks like checking a recipient before you send an email, not copying a spreadsheet of customer details to a personal device, locking your screen, and deleting records you no longer need in line with your retention policy.

Who Is Responsible

The organisation that decides why and how personal data is used is the controller, and it carries overall responsibility. The ICO says every organisation must have a valid lawful basis before it uses personal information, must document that basis and must explain it in its privacy information. There are seven lawful bases, including consent, contract, legal obligation and legitimate interests, and no single basis is better than the others.

Individual staff have responsibilities too. Under section 170 of the Data Protection Act 2018, it is a criminal offence for a person knowingly or recklessly to obtain or disclose personal data without the consent of the controller, or to keep it afterwards without that consent. Looking up a neighbour's record out of curiosity, or taking a client list to a new job, can fall into this.

Data Breaches: Spot It and Report It Internally

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The ICO gives examples that include sending personal data to the wrong recipient, losing a device that holds personal data, and data becoming unavailable.

Where a breach is likely to result in a risk to people's rights and freedoms, the organisation must report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk is high, the people affected must also be told without undue delay. All breaches must be recorded, even those that do not need to be reported.

The clock starts when the organisation becomes aware, which is why staff should escalate a suspected breach straight away rather than trying to fix it quietly. The ICO notes that human error is the leading cause of reported data breaches, and suggests mandatory data protection induction and refresher training as one way to reduce the risk.

Subject Access Requests

People have the right to a copy of their personal information. The ICO says a subject access request can be made verbally or in writing, including through social media, and the person does not need to use any particular words or send it to a particular contact. In most cases the organisation cannot charge a fee and must respond without undue delay and within one month, which can be extended by up to two further months for complex requests.

Because a request can arrive in a phone call or a social media message, frontline staff need to recognise one and pass it on promptly. Since the Data (Use and Access) Act 2025, controllers must also make it easy for people to complain about how their data is handled, and acknowledge a complaint within 30 days.

Common Mistakes

• Sending personal data to the wrong email address or using CC instead of BCC.
• Keeping records "just in case" long after they are needed.
• Collecting more information than the task needs.
• Treating consent as the only lawful basis, or switching basis later without good reason.
• Sitting on a suspected breach instead of reporting it internally straight away.
• Not recognising a subject access request because it was not labelled as one.

Who in a Team the Training Is For

Anyone who handles personal data benefits from data protection awareness training. That includes customer service and sales teams, HR and payroll, managers who hold staff records, and anyone with access to shared drives or customer systems. People with specific roles, such as a data protection officer or the person who handles access requests, will need more detailed training on top.

What Good Training Covers

• What counts as personal data and special category data.
• The seven principles in plain language, with workplace examples.
• How to recognise and escalate a breach, including near misses.
• How to recognise a subject access request or a complaint and who to pass it to.
• Secure habits: checking recipients, locking screens and using approved systems.
• Your own organisation's policies, retention rules and contacts.

How Often Teams Refresh It

The law does not set a fixed interval for refresher training. The ICO's breach guidance points to induction and refresher training as good practice, and it makes sense to refresh when systems, policies or the law change. The Data (Use and Access) Act 2025 has already led the ICO to update several pieces of its guidance, so content written a few years ago may now be out of date.

Frequently Asked Questions

Does UK GDPR Apply to Small Businesses?

Yes. The UK GDPR applies to organisations that handle personal data, whatever their size. What is proportionate may differ, but the principles, lawful basis rules and breach duties still apply.

How Quickly Must a Data Breach Be Reported?

A notifiable breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of the organisation becoming aware of it. Staff should report a suspected breach internally at once.

Can We Charge for a Subject Access Request?

In most cases, no. The ICO says a reasonable fee is only allowed if a request is manifestly unfounded or excessive, or if someone asks for further copies.

What Are the Maximum Fines?

The ICO says breaching the basic principles can lead to a fine of up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher.

Training works best when it is short, relevant to the job and refreshed when things change. If you are planning compliance training for a team, you can book a call to talk it through, or see our courses.