New Years Resolutions That Will Actually Make Your Life Better

How Many Individual Rights Are Set Out in the GDPR?

You are leaving behind data trails whenever you share any personal information. But do you ever wonder if that data is protected? Don’t worry, GDPR is out there to impose data security laws to protect your data. But what data is protected by GDPR?



In this blog, we are going to learn what is GDPR and what data is protected by GDPR and why they do so. 



<h2 class="has-text-color" style="color:#308eeb">What is GDPR?</h2>



We will jump into what data is protected by GDPR as soon as we understand how GDPR works. The General Data Protection Regulation, in short GDPR, is legislation and guideline that secures and gives privacy to our personal data. This law ensures data security, especially for the citizens of the European Union. Their main goal is to protect the people of the EU from any kind of crime that occurs due to personal data breaches. <gwmw style="display:none;">



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/qntjVqzdDebK1qhEMw2QBSbxn4AqBkQL2kp3Giwtc7f0kIPBXOh0ZlDgNcaQ6YwemA2SbOltkd8xC_s6jBv_MisthPtqNbGlKm4fFIQoyC3cO-FExoFyop7gbP2O2ZG_JzmE2LlS" alt="What is GDPR" title="What is GDPR"/></figure>



The GDPR does so by spreading awareness on people's rights on their personal data and how to share them. Also, they enforce strict laws and principles on the organisation that process the data of the people of the EU. Therefore, even if the organisation is operating from other parts of the world, they must abide by the GDPR law to process data of EU citizens.  



GDPR defines terms and roles connected to personal data:&nbsp;



<ul><li>Data subject: The person who owns personal data.</li><li>Data controller: The person or organisation determines what personal data to collect and where and how to use them.</li><li>Data processors: The person or organisation processing personal data for the controller.</li></ul>



The European Parliament approved The <a href="https://gdpr-info.eu/" target="_blank" rel="noreferrer noopener">GDPR legislation</a> for data security and regulation on April 14, 2016. From May 25, 2018, it became fully effective EU wide. GDPR overtook the <a href="https://en.wikipedia.org/wiki/Data_Protection_Directive" target="_blank" rel="noreferrer noopener">EU Data Protection Directive of 1995</a>. It works alongside the <a href="https://www.gov.uk/data-protection#:~:text=The%20Data%20Protection%20Act%202018,organisations%2C%20businesses%20or%20the%20government.&amp;text=Everyone%20responsible%20for%20using%20personal,used%20fairly%2C%20lawfully%20and%20transparently" target="_blank" rel="noreferrer noopener">Data Protection Act (DPA) 2018</a> of the UK. The DPA 2018 is the UK's implementation of the General Data Protection Regulation (GDPR). <gwmw style="display:none;">



Due to technological advancement, there is an increase in cloud storage of mass data.  Without proper data protection, many crimes like identity theft, hacking of accounts, and other data violations are taking place. GDPR takes a strong stance against all kinds of personal data violations.



<h3>Purpose of GDPR</h3>



The main purpose of GDPR is to uphold and protect a strong and uniform data security law on the members of the EU. As a result, member of EU states does not have to write their own data protection law. Also, there will be consistency among the data protection process of the whole EU states. <img width="624" height="375" src="https://lh3.googleusercontent.com/yWPpNXfKkAqyF71sJHK9urtYzPspb63W6a6jI-q1BKIBHHm_4Sg42QXyBK3cSPOF5cttZ6u8rMANCQ0kp4QWUGcDWIN_KDqks-SaQhXaElxha6WYyCDJCDSVsbL6ZuiB8De_MAKf">



GDPR laws imply to the companies and organisations outside the EU. Any company marketing its goods or services to the EU and have direct interaction with EU citizens must comply with GDPR rules and regulations. Therefore, GDPR has a global impact on data protection and privacy. 



According to the new directive of the GDPR, businesses and organisations must handle personal data, maintaining transparency with data subjects. Moreover, under GDPR, companies can't legally process any <a href="https://en.wikipedia.org/wiki/Personal_data" target="_blank" rel="noreferrer noopener">personally identifiable information (PII)</a> without meeting six conditions. These six mandatory requirements of GDPR for privacy and data protection involves:<gwmw style="display:none;">



<ol><li>No matter how big or small the company is or if they are recording personal data manually or using technology, there must be high-security measures to protect them.</li><li>Taking consent from the data subject before processing their personal data.</li><li>In order to protect the privacy of data, anonymise the data.</li><li>Companies must be to show compliance with a legal obligation.</li><li>Ensuring safe transferring and processing of data across the border</li><li>Big companies handling complex and mass data of people must have a data protection officer to look over companies GDPR compliance.</li></ol>



Businesses must also expand the privacy rights of their data subjects. In case of any serious data breach detection, the organisation must notify everyone whose data might be in jeopardy. The GDPR mandates this process within 72 hours of breach detection. If businesses do not meet compliance, there are strict penalties for it.



<h2 class="has-text-color" style="color:#308eeb">What are the 7 Principles of GDPR? </h2>



Companies and individuals must understand GDPR principles to understand what data is protected by GDPR. At the core of GDPR lies complete protection of the personal data of each and every individual of the EU. As a result, companies must follow seven principles when it comes to handling personal data. 



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/kEPFXtoHWWghCrdf6l66UJe4O7vdqRXQMX1jk9Oztq59sRzdTruMka4jxlJa2sX3pX9kZH0b3KoWt5CLkfXk8kG2lK5P0GZOMNFwRc_bAxnZiS9tsYOe80zMNIoehZjMkHYV6-yS" alt="Principles of GDPR" title="Principles of GDPR"/><figcaption><gwmw style="display:none;"></figcaption></figure>



<h3>7 Principles of GDPR</h3>



According to GDPR law, if a company processes personal data, it must depend on seven protection and accountability principles. Here are the total seven principles. <gwmw style="display:none;">



<ol><li>Lawfulness, Fairness, Transparency</li></ol>



The data processing has to be lawful, fair and clear to the data subject.



<ol start="2"><li>Purpose Limitation</li></ol>



The company has to use the data only for the reason for which they took it.



<ol start="3"><li>Data Minimisation</li></ol>



A company must collect and process only the personal data that is completely relevant to the reason the company is taking the data.



<ol start="4"><li>Accuracy</li></ol>



The personal data must be correct and kept up to date.



<ol start="5"><li>Storage Limitation</li></ol>



A company must only keep the data as long as it is necessary for the purpose.



<ol start="6"><li>Integrity and Confidentiality</li></ol>



A company must process data in a way that ensure proper security, integrity and confidentiality.



<ol start="7"><li>Accountability</li></ol>



The company or data controller must be able to demonstrate GDPR compliance with all the Principles.



<h2 class="has-text-color" style="color:#308eeb">What are Your Rights Under GDPR?</h2>



GDPR gives eight specific rights to every individual over the personal data that any organisation is using. These individual's rights help to determine what data is protected by GDPR.



<h3>8 Individual Rights of Data Protection</h3>



The seven principles give you or data subject rights over their personal data whenever an organisation collects and processes them. These 8 data subject rights are:



<ol><li>The right to be informed - An organisation must inform you before taking your data.</li><li>The right of access - You can request access and see your personal data that any organisation is using.</li><li>The right to rectification - You have the right to edit and rectify your data.</li><li>The right to erasure - You can request to erase your personal data or be forgotten.&nbsp;</li><li>The right to restrict processing - You can put a restriction or deny processing your data.</li><li>The right to data portability - You have the right to access and transfer your data.</li><li>The right to object - You can object to data sharing and processing.</li><li>Rights in relation to automated decision-making and profiling.</li></ol>



<h2 class="has-text-color" style="color:#308eeb">What Data is Protected Under GDPR?</h2>



Now to the main question, what data is protected under GDPR. The EU's GDPR takes into consideration any personal data that can identify a person directly or indirectly. To be specific, personal data refers to any information that represents and identifies a real person, directly or indirectly.&nbsp;



<figure class="wp-block-image"><img src="https://lh4.googleusercontent.com/HhL1-YXAr9AsaucA_qk615hHaZfHxFZp1j4wGrxWuA0YBAQ--y_vNp2_yYRClXkCxJb_Kls3ggF5BNS3L4XCPykkoUxfWRQEQPY1Z4UeuJtLHw-QDiEAZ6wNnz-fPrkuZUOTA5kf" alt="What Data is Protected Under GDPR?" title="What Data is Protected Under GDPR?"/><figcaption><gwmw style="display:none;"></figcaption></figure>



GDPR explains the concept of personal data at a greater level. Moreover, the data protection of GDPR applies if the collection of data happens in either of these two ways:



<ol><li>If the processing of personal data happens through automated means like information and electronic forms</li><li>If the personal data processing happens in a non-automated way. Like if the data forms a part or will form part of the filing system, written records, manual filing system.</li></ol>



What data are protected by GDPR falls under six main elements. These are the elements that GDPR takes into account to determine if the information is personal or not.&nbsp;



<ol><li>Natural Person</li></ol>



First, GDPR does not consider it a personal data if the data relates to any non-existent person. Therefore, the data must belong to a legal or an alive person.&nbsp;



<ol start="2"><li>Objective and Subjective Information that Describes a Person</li></ol>



Secondly, any "objective" information like height, age, physical feature and "subjective" information, like employment evaluations, are personal data. This information can be in any specific format. Any video, audio, numerical, graphical, and photographic data may contain personal data.



<ol start="3"><li>Incorrect Information</li></ol>



It is still personal data, even if it happens to be wrong. Whether the data is factually false or it actually belongs to another person, it is personal data as it applies to an identifiable person. However, if data is incorrect to the extent where a person is unidentifiable, it is not personal data.



<ol start="4"><li>Identifiers</li></ol>



Fourthly, any information that can distinguish one person from another is personal data. Pieces of information like a name, an identification number, location data, an online identifier enable us to distinguish one person from another. Further examples of individual identifiers are:&nbsp;



<ul><li>Internet protocol (IP) addresses;</li><li>Cookie identifiers; and</li><li>Other identifiers, such as radio frequency identification (RFID) tags.</li></ul>



<ol start="5"><li>Direct and Indirect Data</li></ol>



Data that indicates to a person directly or indirectly is also personal data. Indirect data are the information that leads to direct information or things that is specific to the person. Another form of indirect identification is when a third party uses your data. They combine it with data they have access to in order to identify an individual.



<ol start="6"><li>Personal Data in Relation to Identifiable Person</li></ol>



GDPR protects the data that identifies a person, even if it doesn't have a name on it. This is because they consider it personal data if someone processes it to learn more about the data subject.



Records include information that is clearly about a specific person. Like their medical history or criminal records, are also personal data. Records that provide information about an individual's activity, such as a bank statement, may also qualify. Personal data is any information about a person that makes them identifiable.



<h2 class="has-text-color" style="color:#308eeb">Summary<gwmw style="display:none;"></h2>



Here’s a simplified answer to what data is protected by the GDPR:



<ul><li>Key identity information such as name, address and ID numbers</li><li>Web data such as location, IP address, cookie data and RFID tags</li><li>Health and genetic information</li><li>Biometric information</li><li>Racial or ethnic data, sexual orientation</li><li>Political opinions</li></ul>



As EU citizens, we have rights to our personal data. Moreover, company owners are liable for protecting our personal data. GDPR ensures all of these. Therefore, we hope you got your answer to what data is protected by GDPR. If you have any confusion or to get professional training, join our <a href="https://apexlearning.org.uk/course/gdpr-2/" target="_blank" rel="noreferrer noopener">GDPR</a> course.<gwmw style="display:none;">

What Data is Protected by GDPR - Everything you Need to Know

We are leaving behind data footprints wherever we are going. We interact with lots of individuals, organisations, companies, and most importantly, we use the internet, where we live behind personal data trails. Do you know, according to the current data protection law, you have the right of requesting personal information under GDPR? If you are giving personal data, you also have the right to access personal data.



You can ask companies, organisations and even social media platforms whether they are storing any kind of personal data on you. This blog is all about familiarising you with GDPR principles and how you can be requesting your personal data under GDPR.<gwmw style="display:none;">



<h2 class="has-text-align-center">What is GDPR?<gwmw style="display:none;"></h2>



It is essential to understand <a href="https://apexlearning.org.uk/course/gdpr-2/">G</a><a href="https://apexlearning.org.uk/course/gdpr-2/" target="_blank" rel="noreferrer noopener">DPR</a> before you go requesting your personal data under GDPR. Firstly, GDPR stands for General Data Protection Regulation. It is a new law and legal guideline to collect and process personal data from people who are part of the European Union (EU).&nbsp;



The GDPR is the strictest privacy and data protection law in the world. Though it is formed and passed by the European Union(EU), it also applies to organisations in other parts of the world that have connections with EU citizens. So no matter from which country the company or site is operating from, if they are to process personal data of European citizens, they have to abide by GDPR law.<gwmw style="display:none;">



<figure class="wp-block-image"><img src="https://lh5.googleusercontent.com/Xa_J0qrZRRz9VFrwqvd32DKZmtYBnllSVF7URc9wiq7_wtb02K3PoShPpToRcJo1qrR7MhJJ7csgdAL6k6BGfW0yrBcd0McAb8XhUWH_VvgdFJQxK1OAgKPRbnlDpOwuYRTZf5xs" alt=""/></figure>



Personal data are information that can help identify a person. If not protected well, people can be a victim of unwanted crimes. The data that can give the identification of a person can simply be their name and numbers. It also includes residential address, IP address, cookie identifier, or other factors that directly relate to an individual. Therefore, if a company is processing personal information that can make a person directly identifiable, they must follow the rules of GDPR.



The GDPR will impose strict penalties against anyone who violates the data privacy and security standards. The fine and penalties increases in magnitude depending on the violation and its impact and can reach up to tens of millions of euros. From May 25, 2018, the GDPR is in action.



Hence, the GDPR stands guard to protect the personal data of EU citizens and maintains a strong ground for data privacy. It is very important in a time when people are providing and entrusting data in cloud services, and data breaches can occur at any time.



<h2 class="has-text-align-center">What are the Principles of GDPR?<gwmw style="display:none;"></h2>



The GDPR establishes seven fundamental principles for the lawful processing of personal data. The principles are at the heart of the GDPR; they serve as the regulation's core tenets and guide compliant processing. The collection, organisation, structuring, storage, alteration, consultation, use, communication, combination, restriction, erasure, or destruction of personal data falls under processing. <gwmw style="display:none;">



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/mfcaWNNekkRN1PyE-OiEmX5Zq6Jezyj0VJk8jh1U0j5Ce1qEkYTXiFtm2DxOB8IrghHTYMAzufeEYSwfMenxqCXzeyk-eyN2Zb5b9jY6QVnknrphn39UPHFNAvlK8fiLhx4Qz6HB" alt=""/></figure>



Therefore, companies must abide by the following principles:



<ol><li>Lawfulness, Fairness and Transparency</li></ol>



Companies must process data lawfully, fairly and maintain transparency while obtaining it.



<ol start="2"><li>Purpose Limitation</li></ol>



The data should be used only for the purpose it was taken for and not beyond that. The company cannot further process data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes if the data was not taken for that purpose.<gwmw style="display:none;">



<ol start="3"><li>Data Minimisation</li></ol>



When collecting personal data, organisations must collect adequate, relevant and limited information that is strictly related to the reason for which the data is taken.



<ol start="4"><li>Accuracy</li></ol>



The stored data must be correct and up to date. Therefore, they must do everything to store the right data. They must also erase or rectify the data as soon as possible if there is any incorrect data.



<ol start="5"><li>Storage Limitation</li></ol>



They must be kept in a form that allows data subjects to be identified for no longer than is compulsory for the reasons for which the personal data are processed.&nbsp;



<ol start="6"><li>Integrity and Confidentiality (Security)</li></ol>



Data should be processed in a way that preserves adequate security of personal data. This involves safeguarding against unauthorised or unlawful processing, as well as accidental loss, destruction, or damage by implementing suitable technical and organisational safeguards.



<ol start="7"><li>Accountability</li></ol>



Controllers of personal data are accountable for adhering to the regulations and regulation letter.  It is also the responsibility of the data controllers to ensure that their processing is consistent.<gwmw style="display:none;">



<h2 class="has-text-align-center">What are The Rights of an Individual Under GDPR?</h2>



Even though the GDPR rules are strictly imposed on data controllers or businesses, their main concern is maintaining the privacy of the data subject. The GDPR's rules, restrictions, and requirements are designed to safeguard data subjects (or users) and preserve their rights. Early in the legislation, the GDPR expresses its commitment to European citizens and data subjects.



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/q2dqX6eWxe10CTFBGbX5oiDu9093B33aYc_c7ByXIetfSjs6OCanXaHMHdzFos5FTdzlt56CVk07lgDPy65odwfQcU285-UmkAEfZzWfeaWTueXGgcRChLFlLvbS2yzz-J9k2TZX" alt=""/><figcaption><gwmw style="display:none;"></figcaption></figure>



<a href="https://gdpr-info.eu/chapter-3/" target="_blank" rel="noreferrer noopener">Chapter 3 of the GDPR guide </a>give an account of individual rights on their data. The Rights of the Data Subjects are:<gwmw style="display:none;">



<ol><li>The Right to Information</li><li>The Right of Access</li><li>The Right to Rectification</li><li>The Right to Erasure</li><li>The Right to Restriction of Processing</li><li>The Right to Data Portability</li><li>The Right to Object</li><li>The Right to Avoid Automated Decision-Making</li></ol>



<h2 class="has-text-align-center">What is the Right to Access?<gwmw style="display:none;"></h2>



The second Right of the data subject is that they have the right to access your data from anyone who has them. Therefore, you have the right to requesting your personal data. As a result, you can request a copy of personal data that is in possession of a data controller or a business. Also, you can ask to see any information that concerns you. The request you make to see your personal data is called Subject Access Request or Access Request.&nbsp;



<figure class="wp-block-image"><img src="https://lh4.googleusercontent.com/sO5_PYYDypZkyW4TOW4KAELnTHxLDM9c8ImdoCJdhwFqGUDHSi8LfqHd5PMoF-dC55GaXwAK7P3q2vAl8UQIPjpnGf11hA2wRlszbyoeGzf8R3BUmd6WCN0mkVQ4SoFjb72whl-7" alt=""/><figcaption><gwmw style="display:none;"></figcaption></figure>



<h3 class="has-text-align-left">What can you Expect from Your Subject Request Access?</h3>



There are some aspects of the Right to access your personal data that an organisation may hold on you. Firstly, they have to confirm if they are processing any of your data. If that is the case, here is the information that they must provide you are:



<ol><li>The purposes of processing the data.</li><li>The categories of personal data that are concerned in the process.</li><li>List of people, groups or other organisations where they are sharing the data. Particularly, notify you if they are disclosing data to any third countries or international organisations.</li><li>If possible, give you the exact timespan they will keep your data in their possession. Or at least the process they use to determine the time they will keep your data.</li><li>They will also provide you with the option on the right to request to rectify or erase your data. Also, you can ask to restrict the processing of your personal data.</li><li>The right to complain to a supervisory authority.</li><li>In case the personal data is not directly collected from you, the organisation has to provide the source of information.</li></ol>



<h3>Additional Information in The Right To Access</h3>



Here is how requesting personal information under GDPR law works in an organisation.



If the personal data is sent to a third country or international organisation, you have the right to be informed. The organisation will also notify you about the data processing method and the safeguarding procedures relevant to the transfer. The transferring process falls under <a href="https://gdpr-info.eu/art-46-gdpr/">Article 46</a> of the GDPR official guidelines.



Moreover, the controller must provide you with a copy of the data that are going through any kind of process. If you request further details or copies of your personal data, the data controller may charge you a small fee according to the administrative cost.&nbsp;



Furthermore, if you make your access request through any electronic means, you will get the information’s through electric means unless you have requested it in some other way. Lastly, the right to obtain a copy of your personal data processing must not adversely affect someone else’s rights and freedoms.



<h2 class="has-text-align-center">Requesting Personal Information Under GDPR</h2>



There is no one way or strict method out there for requesting personal information under GDPR. Therefore, you can make your subject access request verbally or in written form. The Data Protection Commissioner (DPC), however, prefers written access requests. Here is a template.



Dear X,



I would like to make an access request under Article 15 of the General Data Protection Regulation (GDPR) for a copy of the information you have about me, on a computer or in manual form in relation to …



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/jTN_EuOTObIr2TdA-OcpBKODzEVJqo2vzFH0jcVFNN-7hzVyK0fX5mb5iv_y_nxLfhsI6SyQeQyz-0-Pp3Jftk46-LnysLe5E7reAlEG_Q4Xpzq19HK0rXc_87JRvLyd04RD0ATs" alt=""/></figure>



Here are the important steps you can follow for requesting personal information under GDPR for any organisation like a police station according to <a href="https://ico.org.uk/your-data-matters/crime/" target="_blank" rel="noreferrer noopener">ICO</a>:<gwmw style="display:none;">



<h3>Step:1<gwmw style="display:none;"></h3>



<ul><li>Find out where to send your request.</li><li>Think about what personal information you want to access.</li></ul>



<h3>Step: 2 <gwmw style="display:none;"><gwmw style="display:none;"></h3>



<ul><li>Make your request directly to the organisation.</li><li>State clearly what you want.</li></ul>



You might not need all the categories of personal information that an organisation is holding on you. Specifying what information you are exactly looking for will help to access the data as fast as possible.



When you are requesting personal information under GDPR, include the information mentioned below:



<ol><li>Your name and contact.</li><li>Any details that the organisation can use to distinguish you from another person with the same name like an ID or account number.</li><li>Any details or relevant dates that will help specify what information you are looking for.</li></ol>



<h3>Step: 3 <gwmw style="display:none;"></h3>



<ul><li>Keep a copy of your request.</li><li>Keep any proof of postage or delivery.</li></ul>



Important Note:&nbsp;



Your Access Request might be denied in some circumstances. Under <a href="https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/paragraph/14" target="_blank" rel="noreferrer noopener">Schedule 2, Part 2, Paragraph 14 of the Data Protection Act 2018</a> states that: <gwmw style="display:none;"><gwmw style="display:none;">



“The listed GDPR provisions do not apply to personal data processed by (a) an individual acting in a judicial capacity or (b) a court or tribunal acting in its judicial capacity.”



<h2 class="has-text-align-center">Conclusion<gwmw style="display:none;"></h2>



To conclude, requesting personal information under GDPR is your right as a European Union citizen. You can do it for all the organisations that are likely to have your personal data. But you have to provide valid identification and a reason to do so. If you have any questions and confusion, you can join our <a href="https://apexlearning.org.uk/course/gdpr-2/" target="_blank" rel="noreferrer noopener">GDPR</a> course and gain full expertise on this matter.

Blogs