Reform of the UK data protection regime

Implementation date: To be confirmed

The Data Protection and Digital Information Bill reforms the UK data protection regime. The changes include:

  • clarifying when organisations can rely on their legitimate interests as a ground for processing data;
  • limiting some record-keeping requirements to organisations carrying out processing that is likely to pose high risks to individuals' rights and freedoms;
  • replacing the "manifestly unfounded or excessive" exemption that organisations can rely on to refuse a data subject access request with "vexatious or excessive"; and
  • removing data protection officers and replacing them with a requirement to appoint a senior responsible individual to monitor and ensure compliance.

The Bill is currently going through Parliament. It is not yet known when it will come into force.

See Data protection for more information.