UK GDPR (UK General Data Protection Regulation)
Chapter II: Principles – UK GDPR (UK General Data Protection Regulation)

UK GDPR (UK General Data Protection Regulation) Art.5: Article 5 Principles relating to processing of personal data

Personal data must be processed lawfully, fairly and transparently; collected, whether from the data subject or otherwise, for specified, explicit and legitimate purposes and not further processed by or for the controller in a way incompatible with the purposes for which the controller collected it (Article 8A decides compatibility); adequate, relevant and limited to what is necessary; accurate and kept up to date, with inaccurate data erased or rectified without delay; kept in identifiable form no longer than necessary, with longer storage only for archiving, research or statistics carried out under Article 84B; and secured against unauthorised or unlawful processing and accidental loss, destruction or damage. The controller is responsible for, and must be able to demonstrate, compliance (accountability). Article 5(3) adds that processing is not lawful merely because it is compatible with the original purpose: a lawful basis under Article 6 is still needed.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 18 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

UK ICO Guidance on Video Surveillance including CCTV (2022) · 9 controls

  • P.1 P.1 Consider less intrusive alternatives first, aim cameras at the relevant space only, and document the lawful basis before deployment
  • P.10 P.10 Minimum data, good-quality images, accurate time stamps and matching, documented algorithms, and governance features to retrieve and redact
  • P.11 P.11 Retention: the shortest period for the purpose, not the recorder's capacity or default, documented, securely deleted and checked
  • P.3 P.3 Fairness: meet reasonable expectations; cameras in toilets and changing rooms only in the most exceptional circumstances
  • P.7(b) P.7(b) Workplace surveillance: target risk areas with low privacy expectations; continuous monitoring of individuals only in the rarest cases; not rest areas
  • P.8 P.8 Live streaming of identifiable people is processing even without recording
  • T.0 T.0 Linking surveillance systems and matching data: accurate, not excessive, for defined purposes, necessary throughout
  • T.4(b) T.4(b) Facial recognition: documented approach to bias, representative training data, testing, error rates recorded and corrected
  • T.7 T.7 Portable and action cameras: record only where people would expect it, secure devices, inform, crop, and assess first

UK ICO Employment Practices and Data Protection: Monitoring Workers (2023) · 8 controls

  • 1.12(a) 1.12(a) Define and document the purpose; no monitoring just in case
  • 1.13 1.13 Collect no more than needed and review regularly to prevent function creep
  • 1.15 1.15 Retention schedule for monitoring data, justified by business need and reviewed
  • 1.19(b) 1.19(b) Covert monitoring: tightly targeted and time-limited, never in toilets or changing rooms, and not of private communications
  • 1.2 1.2 Monitor only in line with data protection law, with a clear purpose and the least intrusive means
  • 1.8 1.8 Fairness: monitor only as workers would reasonably expect, without unjustified adverse effects
  • 3.3(a) 3.3(a) Call monitoring: not all calls by default, itemised records first, workers told, personal calls not routinely monitored
  • 3.4(b) 3.4(b) Email and message content only exceptionally, with a clear policy and advance notice; network data first

UK Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 · 1 control

  • 4(1)(a) Regulation 4(1)(a) Sole purpose: monitoring or recording communications relevant to the business

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Chapter II: Principles – UK GDPR (UK General Data Protection Regulation)

Query this from an agent

The graph holds this control, the 18 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll UK GDPR (UK General Data Protection Regulation) controls