Sharing and Transferring Personal Data

The Data Protection Act 2018 controls how personal data is collected, used, stored and shared. Personal data is anything that can identify a living person, and the organisation that holds it stays responsible for it even after it has been passed on, so sharing is only allowed when there is a lawful reason.

When data can be shared without consent

Normally an organisation needs a lawful reason, such as the person's consent, before it passes personal data on. The Act gives a lawful reason for sharing without consent in some situations, including to prevent or detect crime and for national security. For example, a council that spots a false housing benefit claim can pass the claimant's details to its fraud investigation team, and a coach company can hand booking records to the security services when a vehicle is linked to a suspected terror plot. In both cases, catching or stopping criminals matters more than the person's wish to keep the data private.

What is prohibited

It is against the Act to sell personal data, or to pass it on, unless there is a lawful reason for doing so. The owner of a cafe who passes a loyalty card member's new address to a leaflet delivery firm, without asking first, has broken the Act. Transferring personal data to countries that do not protect it adequately is also prohibited, because the protection disappears the moment the data crosses the border. A ticket website that stores UK customers' details on a server in a country with no data protection law has broken the Act, even if nothing has gone wrong so far.

Rules for employees

An employee must not knowingly obtain or share personal data without the organisation's permission. A receptionist at a dental surgery who looks up a famous patient's address and passes it to a friend has broken the Act, and so has a payroll clerk who looks up a colleague's salary and tells other staff. The organisation itself has done nothing wrong in either case, but the individual has.