A representative is an organisation that represents you if you are based outside the EU, but you monitor or offer services to people in the EU.

Certain organisations are required to appoint a DPO. This is a person designated to assist with UK GDPR compliance.

There are many different reasons for using personal data, you will know best the particular reasons why you use data. Typical purposes could include marketing, order processing and staff administration.

This is one or more of the bases laid out under Article 6(1) of the UK GDPR.

These are the interests pursued by your organisation, or a third party, if you are relying on the lawful basis for processing under Article 6(1)(f) of the UK GDPR.

This includes anyone that processes the personal data on your behalf, as well all other organisations.

You can tell people the names of the organisations or the categories that they fall within.

Be as specific as possible if you only tell people the categories of organisations.

Say whether the transfer is made on the basis of an adequacy decision by the European Commission under Article 45 of the UK GDPR.

If the transfer is not made on the basis of an adequacy decision, give people brief information on the safeguards put in place in accordance with Article 46, 47 or 49 of the UK GDPR. You must also tell people how to get a copy of the safeguards.

If you don’t have a specific retention period then you need to tell people the criteria you use to decide how long you will keep their information.

The rights will differ depending on the lawful basis for processing – make sure what you tell people accurately reflects this.

The right to object must be explicitly brought to people’s attention clearly and separately from any other information.

Consent must be as easy to withdraw as it is to give. Tell people how they can do this.

Each EU Member State has a designated data protection supervisory authority.

Individuals have the right to raise a complaint with the supervisory authority in the Member State where they live, where they work, or where the infringement took place.

It is good practice to provide the name and contact details of the supervisory authority that individuals are most likely to complain to if they have a problem. In practice, if you are based in the UK, or you regularly collect the personal data of people that live in the UK, you should inform people that they can complain to the ICO and provide our contact details.

Often, this will only apply to some, and not all, of the information being collected. You should be clear with individuals about the specific types of personal data that are required under a statutory or contractual obligation.

Whilst this type of processing may be complex, you should use simple, understandable terms to explain the rationale behind your decisions and how they might affect individuals. Tell people what information you use, why it is relevant and what the likely impact is going to be.

A representative is an organisation that represents you if you are based outside the EU, but you monitor or offer services to people in the EU.

Certain organisations are required to appoint a DPO. This is a person designated to assist with UK GDPR compliance.

There are many different reasons for using personal data, you will know best the particular reasons why you use data. Typical purposes could include marketing, order processing and staff administration.

This is one or more of the bases laid out under Article 6(1) of the UK GDPR.

These are the interests pursued by your organisation, or a third party, if you are relying on the lawful basis for processing under Article 6(1)(f) of the GDPR.

This includes anyone that processes the personal data on your behalf, as well all other organisations.

You can tell people the names of the organisations or the categories that they fall within.

Be as specific as possible if you only tell people the categories of organisations.

Say whether the transfer is made on the basis of an adequacy decision by the European Commission under Article 45 of the UK GDPR.

If the transfer is not made on the basis of an adequacy decision, give people brief information on the safeguards put in place in accordance with Article 46, 47 or 49 of the UK GDPR. You must also tell people how to get a copy of the safeguards.

If you don’t have a specific retention period then you need to tell people the criteria you use to decide how long you will keep their information.

The rights will differ depending on the lawful basis for processing – make sure what you tell people accurately reflects this.

The right to object must be explicitly brought to people’s attention clearly and separately from any other information.

Consent must be as easy to withdraw as it is to give. Tell people how they can do this.

Each EU Member State has a designated data protection supervisory authority.

Individuals have the right to raise a complaint with the supervisory authority in the Member State where they live, where they work, or where the infringement took place.

It is good practice to provide the name and contact details of the supervisory authority that individuals are most likely to complain to if they have a problem. In practice, if you are based in the UK, or you regularly collect the personal data of people that live in the UK, you should inform people that they can complain to the ICO and provide our contact details.

Be as specific as possible and name the individual source(s) the personal data was obtained from. If you can’t do this because you don’t know the specific source, you should provide more general information.

Whilst this type of processing may be complex, you should use simple, understandable terms to explain the rationale behind your decisions and how they might affect individuals. Tell people what information you use, why it is relevant and what the likely impact is going to be.