Category: UK Ch. IV – Controller and Processor

UK GDPR | Art. 24 Controller Responsibilities Article 24 Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural...

UK GDPR | Art. 25 Data Protection by design and by default Article 25 1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of...

UK GDPR | Art. 26 Joint Controllers Article 26 1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their...

UK GDPR | Art. 27 Representatives of controller or processors not established in the United Kingdom Article 27 1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the...

UK GDPR | Art. 28 Processor Article 28 1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and...

UK GDPR | Art. 29 Processing under the authority of the controller or processor Article 29 The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not...

UK GDPR | Art. 30 Records of processing activities Article 30 1. Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility. That record...

UK GDPR | Art. 31 Cooperation with the Commissioner Article 31 The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the Commissioner in the performance of the...

UK GDPR | Art. 32 Security of processing Article 32 1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and...

UK GDPR | Art. 33 Notification of a personal data breach to the Commissioner Article 33 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having...

UK GDPR | Art. 34 Communication of a personal data breach to the data subject Article 34 1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall...

UK GDPR | Art. 35 Data Protection Impact Assessment Article 35 1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to...