Guides
How to apply the law in practice. 43 guides across 11 topics, each written for the person asserting a right, the organisation answering it, or both, and each tied to the provisions it rests on.
New to this? Start with the explainers Plain answers to the first questions: what a DPIA, DPO, lawful basis, breach report or FOI request is, when the law requires one, and what happens if it goes wrong.Principles
The principles, end to end
Seven principles that every other obligation hangs off. What each actually requires, where each is usually breached, and why the seventh is different in kind.
Purpose limitation and compatible reuse
Data collected for one purpose can be reused for another only if the new purpose is compatible, or a recognised exception applies. How the compatibility test works, and the list the DUAA 2025 added.
Transparency and privacy notices
What people must be told, when, and how. A privacy notice is a legal instrument, not a marketing page: every later complaint is tested against it.
Fairness as a distinct test
Processing can be lawful and transparent and still unfair. What fairness adds, how regulators and courts apply it, and the questions that expose an unfair process.
Rights
The rights, and how they interact
All eight rights in one place: what each obliges, which are qualified, and the interactions that catch organisations out when two are exercised together.
Rectification in practice
What Article 16 actually requires, the difference between acting on a correction and acknowledging one, and the notification duty that almost everyone forgets.
Erasure and restriction
The right to be forgotten and its quieter sibling. When each applies, how the exceptions work, and how to honour them in systems that were built to keep everything.
Portability and objection
Two rights that are narrower than people think and stronger than organisations hope. When portability applies, and why objection to direct marketing is absolute.
Rights over children's data
Children have the same rights as adults, exercised by them or for them. Who can make a request, when a parent cannot see what a child has said, and the higher protection duty for online services.
Roles and responsibilities
Controllers, processors and joint controllers
Who decides why is the whole question. How to classify a relationship correctly, what the contract must contain, and why the label on the paperwork does not settle it.
The DPO, and data ownership beyond it
When a data protection officer is mandatory, what the role must be free to do, and why a DPO is not the owner of your data. The DUAA 2025 senior responsible individual proposal did not survive.
Processor contracts and sub-processing
The Article 28 terms every processor contract must contain, how sub-processing must be authorised, and the gaps that turn a processor into a controller.
Representatives and group structures
Organisations outside the UK may need a UK representative. Inside a group, each company is its own controller. How both work, and why intra-group sharing still needs a basis.
Assessments and tests
Choosing and documenting a lawful basis
How to pick a lawful basis for processing, why consent is usually the worst default rather than the safest, and why you cannot quietly swap bases once processing has started.
The legitimate interests assessment
Three separate tests, not one. How to run each, how to attack each, and why "this is how the industry does it" is a habit rather than a lawful basis.
Disclosures to third parties
Every disclosure is processing and needs its own basis. What to record before sharing, and what to ask for when you discover a share you did not expect.
Data protection impact assessments that are worth doing
When a DPIA is genuinely required rather than merely prudent, how to scope one so it is useful, what makes a DPIA worthless, and who has to own the outcome.
Transfer risk assessments
Since 2026-02-05 a restricted transfer under an Article 46 safeguard must pass the data protection test. What the test asks, how to document it, and how it differs from the EU approach.
Special category and criminal offence conditions
Special category data needs a lawful basis and a separate condition. How the UK conditions work, when an appropriate policy document is required, and how criminal offence data differs.
Data lifecycle
Retention: schedules, deletion and the backup gap
Why a retention schedule beats ad-hoc deletion, why "keep it forever" is a liability rather than an asset, and the persistent gap between a deletion policy and what your backups actually do.
Anonymisation and pseudonymisation
One takes data out of scope entirely; the other does not. Why the distinction is the most consequential in the whole regime, and why most claimed anonymisation is not.
Data minimisation in practice
Adequate, relevant and limited to what is necessary. Turning the principle into design decisions: what to collect, what to keep, and what to stop doing.
Collection and onward reuse
Data obtained from third parties, scraped from the web or reused from another system brings its history with it. How to check provenance at the point of collection.
Security and design
Appropriate technical and organisational measures
What "appropriate" means when nothing is prescribed, why design and default are separate obligations, and how security failures become principle failures.
Privacy by design and by default
Article 25 makes privacy a design requirement, not a review step. What by design and by default each require, and how to show you did it.
Access control and least privilege
Most breaches involve someone who could see data they did not need. Access control is where security and minimisation meet, and where insider offences begin.
Data classification
You cannot protect what you have not labelled. A classification scheme that maps to data protection risk, not just confidentiality, and how to make people use it.
Automation and AI
Automated decisions, profiling and AI
When a decision is "solely automated", why meaningful information about the logic is not the source code, and where model training sits in the framework.
AI governance and model data
How UK data protection applies to building and using AI: lawful basis for training, transparency, accuracy of outputs, rights against models, and the automated decision rules.
Training data provenance
Where training data came from decides whether you can lawfully use it. Recording provenance, handling scraped data, and keeping the trail that lets you answer rights requests.
Data governance
Data quality
Accuracy is a legal obligation and quality is a broader operational one. The dimensions worth measuring, why quality failures become rights failures, and where to intervene.
Stewardship and the operating model
Who owns what, how the roles actually divide, and why a governance function with no decision rights produces documents instead of change.
Catalogues, lineage and metadata
A data catalogue and lineage map are what turn the record of processing from a spreadsheet into something that answers rights requests and breach questions in hours, not weeks.
Data sharing agreements
Sharing between controllers needs a lawful basis, transparency and, in practice, a written agreement. What the agreement should contain and how the statutory data sharing code shapes it.
Maturity and assurance
How to judge whether a data protection programme works, not just whether it exists. Maturity levels, the evidence each needs, and how the regulator's accountability framework fits.
Accountability
Records of processing that earn their keep
What a record of processing activities is actually for beyond compliance theatre, the minimum content that is genuinely useful, and how a ROPA decays if you do not wire it to change.
When to report yourself
Why an unauthorised disclosure can be a notifiable breach even though nothing was hacked, and why a documented "not notifiable" is a good outcome but no assessment is not.
Policy frameworks and standards
Which policies a data protection programme needs, how they relate to each other, and how to keep them from becoming documents nobody follows.
Audit, assurance and evidence
Demonstrating compliance means keeping evidence. What to keep, how to audit your own programme and your processors, and what the regulator can require you to produce.
Complaints and disputes
Making a complaint that lands
How to structure a data protection complaint so it cannot be deflected: the order to put things in, what to ask for, and the sentences that make delay measurable.
Handling a complaint you have just received
A first-hour checklist for the DPO, how to recognise correspondence that is no longer a customer-service ticket, and the three failures that turn a small complaint into a regulatory one.
Regulators and escalation routes
Where a data protection or information rights dispute goes after the organisation: the Information Commission, the Scottish Information Commissioner, tribunals and the courts, and which route fits which problem.
Worked examples
How the Atlas works
How to read an instrument profile
Every instrument page answers the same ten structural questions and keeps criminal, civil and regulatory consequences apart. What each section tells you, and why it is laid out that way.
Reserved and devolved, why UK information law splits two ways
Data protection is reserved, so the UK has one regime. Freedom of information is devolved in Scotland, so it has two. The split decides which law, which regulator and which procedure applies.
Each guide is also mapped to the NIST Privacy Framework functions and ISO/IEC 27701:2019 controls it supports, so it can be read alongside a management system as well as the statute. The ISO control identifiers follow the mapping published in mukul975/Privacy-Data-Protection-Skills (Apache-2.0).