Updated to reflect new rules on time limits for responding to data subject access requests, in place from 5 February 2026 under the Data (Use and Access) Act 2025.
Updated to reflect the addition of recognised legitimate interests as a lawful ground for processing data introduced under the Data (Use and Access) Act 2025, in force from 5 February 2026.
This guide sets out when an organisation is required to appoint a data protection officer and what the roles and responsibilities of a data protection officer are.
This guide sets out the requirement for data controllers to provide data subjects with a privacy notice explaining what data they hold on them and what they do with that data.