What Does GDPR Actually Mean?

GDPR stands for General Data Protection Regulation. It is part of the main legal framework governing how UK organisations use personal data.

Lowdown

In the UK, the main rules are in the UK GDPR and Data Protection Act 2018, as amended by legislation including the Data (Use and Access) Act 2025. Personal data means information relating to an identified or identifiable living person.^[1]

Why It Matters

A few terms make the rules easier to understand.

Personal data can include names, contact details and IP addresses where they identify someone. Processing means almost anything you do with that data, including collecting, storing, reading, sharing or deleting it.^[1][2]

A controller decides why and how personal data is used. A processor handles it on the controller's behalf and under their instructions. Where a supplier acts as a processor, a written contract containing the required data protection terms is needed.^[3]

A lawful basis is a valid legal reason for processing personal data. There are seven under the current UK GDPR, including consent, contract, legitimate interests and recognised legitimate interests. The appropriate basis depends on why the data is being used.^[4]

Our Conclusion

GDPR is easier to manage once you understand the basic terms. Start with what personal data you hold, why you use it and who else handles it.

Sources

[1] GOV.UK, The UK's data protection legislation and ICO, Data protection principles, definitions and key terms

[2] ICO, Legal definitions – Processing

[3] ICO, Controllers and processors and ICO, When is a contract needed and why is it important?

[4] ICO, Lawful basis and GOV.UK, Data (Use and Access) Act 2025: UK GDPR and DPA factsheet