Lawful Basis and Fair Processing

An organisation can only handle your personal data if it has a lawful reason — an accepted justification for collecting and using it. The Data Protection Act 2018 permits an organisation to gather, keep and use personal data where a lawful reason exists and the Act's rules are followed, and it bans gathering and use of personal data where no lawful reason exists.

There are several different lawful reasons. A person clearly agreeing to their data being used is one of them, but it is not the only route, so an organisation is not automatically acting illegally just because nobody was asked to tick a box.

Fairly and openly

Personal data must be used fairly and openly: people must be told clearly what is being collected and what it will be used for. Wording it so vaguely that nobody can tell what will happen is not open. For example, a dance school enrolling new pupils should state that it is collecting a parent's phone number so it can text class reminders, rather than just asking for the number with no explanation.

Only for the stated purpose

Personal data may be used only for the purpose that was stated at the point it was gathered. Turning it to a different, unrelated purpose is prohibited. The dance school can send class reminders, but if it later passes those same numbers to a holiday club it runs, that is a purpose nobody was told about, so it is not allowed. It could only do so if there were a lawful reason for the new use and people had been told about it.

What the Act allows and prohibits