The government introduced the DPDI Bill to replace the UK GDPR post-Brexit. What does this mean? Whom does it affect? We unpack all you need to know.
The UK GDPR post-Brexit reflected many of the previous provisions and has stood alongside the Data Protection Act 2018. Until now.
The Data Protection and Digital Information (DPDI) Bill was introduced to parliament as the centre of the government's plan to reform the GDPR and other EU-based legislation. With a more independent framework, there will be some changes to the UK GDPR as we know it.
The DPDI was previously known as The Data Reform Bill and originated from the Department for Culture, Media and Sport (DCMS) consultation in 2021. According to the UK government, this new legislation aims to simplify the current data protection framework by making it more UK-centric.
The Bill proposes to reform the UK GDPR, DPA 2018 and Privacy and Electronic Communications Regulations (PECR) 2003. The current regime will remain in place but be subject to the amendments proposed by the Bill.
The Bill will establish new rules on web cookies and digital identity that simultaneously protect users' rights while reducing the compliance burden on UK firms, particularly small businesses.
The Bill proposes new provisions around the use of personal data for research and the requirement to report unlawful direct marketing to the ICO.
In line with this, some of the most notable changes will include:
The DPDI will bring about a change in the way businesses collect and process personal data. Some of the practical changes include:
In general, businesses will need to review their risk management systems and procedures in relation to data protection. It is advisable to keep an eye out for any changes in the lead-up to the enactment of the DPDI.
Under the DPDI, breaches under PECR will fall under GDPR, resulting in higher fines. Currently, the highest fine for infringing on web cookies or direct marketing rules is £500k. This fine could increase to as much as 4% of global annual turnover.
The Information Commissioner's Office (ICO) will continue to operate in the same capacity as they have been in the post-Brexit era. It remains the data supervisory authority for the UK. The ICO will account for the amendments to the current regime when issuing penalties for breaches in legislation.
For the latest information and guidance, keep checking back to the ICO website.
In order to achieve GDPR compliance, companies need to ensure they know their data sources, categorise their data, have plans if there is a breach, review policies and educate their staff.
Despite the GDPR taking effect in 2018, many companies are still not GDPR compliant. A recent study indicates that nearly three-quarters of UK companies don’t follow GDPR data request requirements.
The lack of effective data protection training has already resulted in numerous and significant GDPR fines. The rules are fairly clear, meaning that almost all fines are completely avoidable.
We've created a comprehensive GDPR roadmap to help you navigate the compliance landscape, supported by a comprehensive library of GDPR Courses.
We also have 100+ free compliance training aids, including assessments, best practice guides, checklists, desk-aids, eBooks, games, posters, training presentations and even e-learning modules!
Finally, the SkillcastConnect community provides a unique opportunity to network with other compliance professionals in a vendor-free environment, get priority access to our free online learning portal and other exclusive benefits.