UK GDPR’s seven principles, in plain English

What are the seven UK GDPR principles?

The table pairs each principle with a plain meaning and an example action. The actions are illustrations to help you think about your work, not a complete assessment of whether your organisation meets the rules.

What would this look like on a booking form?

Imagine a small business taking a room booking. Its form asks for a name and a way to send confirmation. Before adding another field, the team asks what it will use that answer for. This is a fictional example of planning the form.

Data minimisation means having the information you need, without collecting extra detail just because it might be useful. It does not mean gathering so little that you cannot do the job properly.

The business should define and record the purpose, then tell people about it. If it later wants to use booking details for another purpose, it needs to check that new use before going ahead.

Can you use the information for a new purpose?

Check the new purpose and the lawful basis, meaning the legal reason for using the data. The ICO says a compatible new purpose does not, by itself, make the use lawful. An appropriate lawful basis is still needed.

Where the original use relied on consent, the rules on reusing that information are more restrictive. Do not assume that permission for the first task covers a new one.

For the fictional booking form, write down the proposed new use before changing the form or reusing existing records. That gives the team a clear decision to assess.

How long should you keep personal data?

The principle is to keep data in a form that identifies people only for as long as its purpose needs. It does not set the same storage period for every record.

Ask what you still need the record for and record the reason. In the booking example, a useful review question is whether the original enquiry still needs to sit in a shared inbox.

There are specific provisions for longer storage solely for public interest archiving, scientific or historical research, or statistical purposes. Those uses have conditions and safeguards. They are not a general reason to keep ordinary business records forever.

What does accountability add?

Accountability means being responsible for the principles and able to show that you follow them. UK GDPR sets out the processing principles, then makes that responsibility explicit.

A useful decision record says what was decided and why. It gives the next person something to review when the work changes. The ICO’s advice on records is brief.

The ICO flags its principles guidance as under review after the UK’s Data (Use and Access) Act. The statutory duties in this guide are also checked against the UK GDPR text.

What to do

1. Describe each use of personal data and its purpose.
2. Check that the data collected is enough for that purpose, without unnecessary detail.
3. Review accuracy, storage and security.
4. Record the decisions and keep them under review.

Common questions

Does data minimisation mean collecting as little as possible?

It means collecting what is adequate, relevant and needed for the purpose. Too little information can also prevent the job being done properly.

Does good security cover all the principles?

No. Security is one part of the duty. You also need to address matters such as fair use, purpose, accuracy and how long data is kept, and be able to show how you do so.

Where next

• Does GDPR apply to small businesses and sole traders?
• Who is a data controller, and who is a processor?
• Is UK GDPR changing in 2026?

This is an independent editorial guide, not legal advice.