Reform of the UK data protection regime

Implementation date: To be confirmed

The Data Protection and Digital Information Bill reforms the UK data protection regime. The changes include:

• clarifying when organisations can rely on their legitimate interests as a ground for processing data;
• limiting some record-keeping requirements to organisations carrying out processing that is likely to pose high risks to individuals' rights and freedoms;
• replacing the "manifestly unfounded or excessive" exemption that organisations can rely on to refuse a data subject access request with "vexatious or excessive"; and
• removing data protection officers and replacing them with a requirement to appoint a senior responsible individual to monitor and ensure compliance.

The Bill is currently going through Parliament. It is not yet known when it will come into force.