Archives and data protection law in the UK

As of 25 May 2018, there are new laws around data protection in the UK.

The Data Protection Act 1998 has been replaced by The Data Protection Act 2018 (DPA 2018). This results from new legislation in the EU: the General Data Protection Regulation (GDPR). The DPA 2018 makes additional provisions around areas not covered by GDPR.

These web pages provide an overview of the key implications of the new legislation for archives and archiving.

Archives and data protection law in the UK

Archives and GDPR: frequently asked questions

Where can I find general advice? Is there a checklist to show what organisations need to do to prepare for GDPR and changes to UK data protection law? Do the eight Data Protection Principles from the 1998 Act still apply? Does the new legislation represent a significant change in approach for archives and archivists? What exactly is 'archiving purposes in the public interest'? What does this mean for archives? Does ‘public interest’ mean only public bodies are covered? What doesn’t it cover? What is meant by ‘processing’ for archiving purposes in the public interest? Do I have to do anything specific in order to be able to use the 'archiving purposes in the public interest' exemption? Do I need to tell users I am ‘archiving in the public interest’? What are the possible exemptions? What is the ‘right to be forgotten? Are there any exceptions to this? What are the ‘safeguards’? What constitutes serious damage or distress? Does the process for responding to subject access requests change under the new legislation? Am I still able to accept correspondence from living people, including emails, as part of a deposit? Do I have to remove personal data? I currently ask archives users to sign a data protection undertaking where records contain personal data.