UK GDPR, read alongside the Data Protection Act 2018, requires you to follow seven principles, protect personal data with appropriate security, and report notifiable breaches to the ICO within 72 hours where feasible. The Data (Use and Access) Act is amending parts of the regime, and the ICO says some guidance is under review.
What are the seven principles?
Article 5 of the UK GDPR, as quoted in ICO guidance, lists them: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability.
For an engineer each one has a build-time meaning. Minimisation means not collecting a field you will never use. Storage limitation means a retention job that actually deletes. Accuracy means a path to correct a record. Purpose limitation means data collected for billing is not quietly fed into a marketing model. The ICO notes it updated its purpose limitation page in March 2026 to reflect Data (Use and Access) Act changes on compatibility and reuse of personal information, so check that page if you plan reuse.
What does the security principle ask for?
The ICO's data security guide says you must process personal data securely by means of appropriate technical and organisational measures. You do a risk analysis, take account of the state of the art and cost, and pick measures that fit your circumstances and the risk. Where appropriate, use pseudonymisation and encryption. Your measures must protect confidentiality, integrity and availability, let you restore access in a timely way after an incident, and be tested regularly.
The ICO worked with the National Cyber Security Centre on its approach and points to established frameworks such as Cyber Essentials for basic technical controls. Processors are covered by the same security duties.
What is the breach rule?
The ICO's breach guide says the UK GDPR places a duty on all organisations to report certain personal data breaches to the ICO within 72 hours of becoming aware, where feasible. If the breach is likely to result in a high risk to individuals, you must also tell those individuals without undue delay. A breach is broader than theft: it includes unauthorised access, sending data to the wrong recipient, alteration without permission and loss of availability.
Processors must tell the controller without undue delay once aware, and the contract under Article 28 should set out the breach reporting terms. You must keep a record of all breaches, including those you do not report, and be able to justify a decision not to report. The ICO says failure to notify can bring a fine of up to £8.7 million or 2 per cent of global turnover.
Constructed example: a support engineer exports a customer list to a spreadsheet and emails it to the wrong address. That is a personal data breach. The team logs it, assesses the risk, and notes whether notification is needed. The log entry is the evidence either way.
When is a DPIA needed?
A data protection impact assessment is needed for processing likely to result in high risk. ICO guidance discusses how to run one, and it is under review following the Data (Use and Access) Act. For a new analytics feature that profiles users, run the assessment before launch, not after.
What did the Data (Use and Access) Act change?
The ICO says the Act changes PECR breach reporting from 24 hours to 72 hours after becoming aware, and amends purpose limitation provisions. Several guidance pages carry a banner saying they are under review. We could not fetch the Act itself for this post, so read the ICO's plans for new and updated guidance, and legislation.gov.uk, before relying on a specific amended provision.
What to do
- Map the personal data you hold, where it is stored, and who processes it.
- For each store, write the purpose, the retention period and the deletion mechanism.
- Run a risk analysis, and record the technical measures chosen: encryption, access control, backups, testing.
- Keep Article 28 contracts with each processor, including breach notice terms.
- Write a breach procedure with a named owner, the 72 hour clock and a breach log.
- Run a DPIA before launching high-risk processing.
- Check the ICO guidance pages that carry the under review banner before you finalise decisions.
- Keep dated evidence of all of the above.
Safeguard compliance automation can help organise evidence against a framework. It does not make you compliant, and legal interpretation stays with your counsel.
Quick check
Is the UK GDPR the same as the EU GDPR?
It is the retained version in UK law, read with the Data Protection Act 2018. The core principles are the same in shape, but the regimes can diverge, so check the UK text.
Do I always report a breach to the ICO?
No. Report notifiable breaches within 72 hours where feasible. Record every breach and document why you chose not to report one.
Sources
- A guide to the data protection principles, ICO, fetched 18 October 2026
- A guide to data security, ICO, fetched 18 October 2026
- Personal data breaches: a guide, ICO, fetched 18 October 2026
- Data Protection Impact Assessments, ICO, fetched 18 October 2026
Last reviewed: 18 October 2026.
