- Project plans
- Project activities
- Legislation and standards
- Industry context
- Specialist wikis
Last edited 01 Oct 2021
General Data Protection Regulations (GDPR)
GDPR resulted from EU legislation which updated data protection legislation into line with the numerous ways that data is now used. Hitherto, the UK abided by the Data Protection Act 1998. This was superseded by the GDPR legislation and ushered in higher penalties for breaches and non-compliance.
Although the key principles of data privacy still hold true to the previous directive (95/46EC), many changes have been proposed to the regulatory policies; the key points of the GDPR as well as information on the impacts it will have on business can be found below.
 What are the key changes?
The key changes are provided under the GDPR website, and it is advised to visit this portal for the most up-to-date information to ensure you and/or your organisation are compliant. However, the key changes are described as:
Companies will no longer be able to use long illegible terms and conditions full of legalese, as the request for consent must be given in an intelligible and easily accessible form, with the purpose for data processing attached to that consent (EUGDPR.ORG Portal, 2018).
 Roles: 'Controller' or 'Processor'
- Controllers determine the purposes and means of processing personal data.
- Processors are responsible for processing personal data on behalf of a controller.
- Breach Notification to become mandatory in all EU member states where a data breach is likely to "result in a risk for the rights and freedoms of individuals". This must be done within 72 hours of first having become aware of the breach. Data processors will also be required to notify their customers, the controllers, "without undue delay" after first becoming aware of a data breach.
- Right to access is the right for data subjects to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what purpose. Further, the controller shall provide a copy of the personal data, free of charge, in an electronic format.
- Right to be forgotten/Data erasure entitles the data subject to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data.
- Data portability is the right for a data subject to receive the personal data concerning them, which they have previously provided in a 'commonly used and machine readable format' and have the right to transmit that data to another controller.
- Privacy by design calls for the inclusion of data protection from the onset of the designing of systems, rather than an addition. More specifically - 'The controller shall..implement appropriate technical and organisational measures..in an effective way.. in order to meet the requirements of this Regulation and protect the rights of data subjects'.
- Under GDPR, Data Protection Officers (DPO) will not be required to submit notifications / registrations to each local DPA of data processing activities. Instead, there will be internal record-keeping requirements. DPO appointment will be mandatory only for those controllers and processors whose core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale or of special categories of data or data relating to criminal convictions and offences.
 Will GDPR matter for organisations in the UK after Brexit?
If companies in the UK process data about individuals in the context of selling goods or services to citizens in other EU countries then they will need to comply with the GDPR, irrespective as to whether or not the UK retains the GDPR post-Brexit.
 What should you do next?
 About this article
 Related articles on Designing Buildings Wiki
Featured articles and news
From biometric to electrical current, chemical and more.
Changes are due to come into force on 1st October 2022.
Heed advice and insight of this report IPA tells the government.
From the Commonwealth Association of Architects.
For the Levelling Up, Housing & Communities Committee.
BSRIA's Technical Director reflects on recent weather patterns.
A national valuation to fund old-age pensions.
The world’s largest Commonwealth memorial to the missing.
Long after the end of the defects liability period.
Occupant satisfaction and wellbeing in buildings.
From the simple to the complex.
And the UK Government guidelines.
Commitment agreed to by major built environment bodies.
Electrical skills, low carbon, high-tech and the building services revolution.
Ultra-deep drilling with millimeter-wave beam technology.
Looking at the built environment from space.
BSI standards 8671, 8672 and 8673.
Bringing life to burial grounds.
From failed modernism to twenty-minute neighbourhoods.
The gates process and change control.
Why people behave as they do. APM book.