UK GDPR and Operational Records: A Governance Guide for Directors

Procedures, project files, support histories and review notes describe how work is done. In doing so they routinely mention the people who do it and the people it is done for. Names, email addresses, job titles, case details and combinations of facts that identify a person all count as personal data under the UK GDPR and the Data Protection Act 2018, including where they sit inside a document that is mainly about process.

A board does not need to become expert in the detail. It does need to know which questions to ask, who is accountable for the answers and what evidence should exist before any discussion with a prospective licensee begins.

A controller decides why and how personal data is processed. A processor processes it on a controller's behalf and on its instructions. The distinction determines who may decide to license data at all. An organisation that holds client data only to deliver a service is often a processor. It generally cannot decide for itself to use that data for a new purpose. The ICO's guidance on controllers and processors explains how to assess the roles.

For each category of record, record whose data it is and in what capacity you hold it. Where you are a processor, the controller's authority is needed, and your contract with them may prohibit use altogether.

Processing personal data requires a lawful basis. The ICO's guide to lawful basis currently lists seven: consent, contract, legal obligation, vital interests, public task, recognised legitimate interest and legitimate interests. Licensing existing records to a third party is a new use of data collected for another purpose, such as serving a customer or employing a person. Whether that new use is permitted turns on the original purpose, what people were told and how the law treats compatibility between purposes.

If an organisation relies on legitimate interests, it should document a legitimate interests assessment: the interest, why the processing is necessary and how it balances against the rights and expectations of the people affected. Where the data is special category or concerns criminal matters, further conditions apply, and the case for sharing is usually much harder to make.

People are entitled to know how their data is used. Privacy information given when the data was collected may not mention licensing to third parties. The ICO's right to be informed guidance describes what organisations must tell people, including purposes, retention and recipients. If your existing notices do not cover the new use, that is a significant obstacle for any record that still contains personal data.

The most common response to these risks is to remove personal data before sharing. That can work, but only if done properly. The ICO's anonymisation guidance explains that anonymisation is about whether people can be identified by means reasonably likely to be used, and it treats identifiability as a spectrum, with tests including how a motivated person with access to other information might proceed. Pseudonymised data, where identifiers are replaced by codes, is still personal data.

• Define precisely what is removed, transformed or generalised, and by whom.
• Test the result, including free-text fields, comments and attachments, which routinely retain identifiers.
• Document the method, the residual risk and the standard applied.
• Do not describe material as anonymous in an agreement unless you can evidence that it is.

A DPIA is a structured assessment of risks to individuals from a planned use of personal data. It is required where processing is likely to result in a high risk. The ICO's DPIA guidance explains when one is needed and how to carry it out, and notes that its guidance is under review. Large-scale sharing of records that include staff or customer information is the kind of plan that warrants at least a documented screening decision on whether a DPIA is needed.

If a recipient is outside the UK, sending or making personal data available to them is a restricted transfer requiring a recognised mechanism. The ICO's international transfers guide sets out the options. If the records have been genuinely anonymised, the transfer rules for personal data do not apply to them, which is another reason the anonymisation question deserves rigour.

Buyers or their service providers based in the United States may also be subject to US state privacy laws in respect of their own activities. As one example, the California Attorney General explains the California Consumer Privacy Act, which applies to businesses meeting specified thresholds. How such laws apply to a particular arrangement is for US-qualified counsel.

People retain rights over their personal data, including access, correction, erasure and objection. Once data has been shared, can you honour them? The agreement should address how requests are passed on and acted upon, and what deletion obligations the licensee has.

Accountability means being able to show your reasoning. Before any approach, a prudent organisation can produce:

• a record of what categories of record exist and what personal data they contain;
• the roles analysis for each category;
• the lawful basis and compatibility assessment, or the conclusion that no personal data is in scope;
• the anonymisation method and its testing, where relied upon;
• a DPIA or a documented decision that none is needed;
• the privacy information currently given to affected people;
• a breach response plan. Reportable personal data breaches must generally be notified to the ICO within 72 hours of becoming aware (see the ICO's breach guidance);
• evidence that the ICO data protection fee position is in order.

Where an organisation has no dedicated role, the same functions still need an owner, whether internal or external. Our board paper guide shows how to present these decisions for approval.

We do not review records, perform data protection assessments or clear data for release. Those judgements are yours and your advisers'. We are an independent introduction service, and we explain how we are paid on our disclosure page.