General Data Protection Regulation Data protection principles
The 1998 Act sets out eight data protection principles and these are largely carried over to the GDPR as set out in the table below. The GDPR also provides a new accountability principle.
The former Data Protection Act 1998 principles
The new General Data Protection Regulation principles
Lawfulness
i. Personal data shall be processed fairly and lawfully and according to conditions.
Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
Purpose
ii. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data minimisation
iii. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Accuracy
iv. Personal data shall be accurate and, where necessary, kept up to date.
Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
Storage
v. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Access
vi. Personal data shall be processed in accordance with the rights of data subjects.
The GDPR does not have an equivalent principle.
Instead access rights are found separately in Chapter III of GDPR.
Security
vii. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data
Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Overseas transfer
viii. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data
The GDPR does not have an equivalent principle.
Instead overseas transfers of personal data are addressed separately in Chapter V.
Accountability
The 1998 Act does not have an equivalent principle.
The controller shall be responsible for, and be able to demonstrate, compliance with the principles.