# UK GDPR’s seven principles, in plain English

Turn the rules into everyday checks on the information your organisation uses.

The Assurance Desk. Published 9 October 2026. Last checked 9 October 2026.

**The short answer.** UK GDPR’s seven principles cover fair and lawful use, clear purposes, collecting only what is needed, accuracy, keeping data only as long as needed, security and accountability. They apply together. Keeping data secure does not remove the need to explain why you use it ([ICO, A guide to the data protection principles](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 9 October 2026).

## In this series

- [Data protection training: what should staff learn?](https://theassurancedesk.com/guides/data-protection-training-for-staff.md)
- [Keeping personal data secure: what Article 32 requires](https://theassurancedesk.com/guides/keeping-personal-data-secure-article-32.md)
- [A subject access request arrives: what should you do?](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md)
- [UK GDPR versus EU GDPR: which rules apply?](https://theassurancedesk.com/guides/uk-gdpr-vs-eu-gdpr.md)
- [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md)

## What are the seven UK GDPR principles?

The table pairs each principle with a plain meaning and an example action. The actions are illustrations to help you think about your work, not a complete assessment of whether your organisation meets the rules ([ICO, A guide to the data protection principles](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/), [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5) and [ICO, Principle (b): Purpose limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/), checked 9 October 2026).

**Seven principles, with everyday examples**

| Principle | Plain meaning | Example action |
| --- | --- | --- |
| Lawfulness, fairness and transparency | Use data lawfully and fairly. Be open about what you do. | Explain why a booking form asks for contact details. |
| Purpose limitation | Have clear purposes. Check before using data for something else. | Review a proposed new use of an old customer list. |
| Data minimisation | Collect and keep enough for the job, without unnecessary detail. | Remove form fields that serve no purpose. |
| Accuracy | Keep information accurate and up to date where needed. | Correct an address when a customer reports an error. |
| Storage limitation | Keep identifiable data only as long as needed for its purpose. | Set a reasoned review point for old enquiry records. |
| Integrity and confidentiality | Protect data against unauthorised use, loss or damage. | Limit access and check how records can be recovered. |
| Accountability | Be responsible for these duties and able to show how you meet them. | Keep the reason for a data decision, not just its outcome. |

Source: ICO, A guide to the data protection principles, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/ (checked 9 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/5 (checked 9 October 2026); ICO, Principle (c): Data minimisation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/ (checked 9 October 2026); ICO, Principle (b): Purpose limitation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/ (checked 9 October 2026); ICO, Guide to accountability and governance, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/ (checked 9 October 2026)

## What would this look like on a booking form?

Imagine a small business taking a room booking. Its form asks for a name and a way to send confirmation. Before adding another field, the team asks what it will use that answer for. This is a fictional example of planning the form.

Data minimisation means having the information you need, without collecting extra detail just because it might be useful. It does not mean gathering so little that you cannot do the job properly ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5) and [ICO, Principle (c): Data minimisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/), checked 9 October 2026).

The business should define and record the purpose, then tell people about it. If it later wants to use booking details for another purpose, it needs to check that new use before going ahead ([ICO, Principle (b): Purpose limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/), checked 9 October 2026).

**Follow the data through the job**

1. Before collecting: Describe the purpose and the information needed.
2. While using: Use the information for the stated purpose and correct errors.
3. When reviewing: Check what still needs to be kept and protected.
4. Keep the record: Record the decisions and revisit them when the work changes.

A planning sequence for the fictional booking form. Each decision needs a reason.

Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/5 (checked 9 October 2026); ICO, Principle (b): Purpose limitation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/ (checked 9 October 2026); ICO, Guide to accountability and governance, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/ (checked 9 October 2026)

## Can you use the information for a new purpose?

Check the new purpose and the lawful basis, meaning the legal reason for using the data. The ICO says a compatible new purpose does not, by itself, make the use lawful. An appropriate lawful basis is still needed ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5) and [ICO, Principle (b): Purpose limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/), checked 9 October 2026).

Where the original use relied on consent, the rules on reusing that information are more restrictive. Do not assume that permission for the first task covers a new one ([ICO, Principle (b): Purpose limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/), checked 9 October 2026).

For the fictional booking form, write down the proposed new use before changing the form or reusing existing records. That gives the team a clear decision to assess.

## How long should you keep personal data?

The principle is to keep data in a form that identifies people only for as long as its purpose needs. It does not set the same storage period for every record ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 9 October 2026).

Ask what you still need the record for and record the reason. In the booking example, a useful review question is whether the original enquiry still needs to sit in a shared inbox.

There are specific provisions for longer storage solely for public interest archiving, scientific or historical research, or statistical purposes. Those uses have conditions and safeguards. They are not a general reason to keep ordinary business records forever ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 9 October 2026).

## What does accountability add?

Accountability means being responsible for the principles and able to show that you follow them. UK GDPR sets out the processing principles, then makes that responsibility explicit ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 9 October 2026).

A useful decision record says what was decided and why. It gives the next person something to review when the work changes. The ICO’s advice on records is brief ([ICO, Guide to accountability and governance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/), checked 9 October 2026).

The ICO flags its principles guidance as under review after the UK’s Data (Use and Access) Act. The statutory duties in this guide are also checked against the UK GDPR text ([ICO, A guide to the data protection principles](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 9 October 2026).

> "keep records of what you do and why."
> ICO, Accountability guidance
> ICO, Guide to accountability and governance, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/ (checked 9 October 2026)

## What to do

1. Describe each use of personal data and its purpose ([ICO, Principle (b): Purpose limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/), checked 9 October 2026).
2. Check that the data collected is enough for that purpose, without unnecessary detail ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5) and [ICO, Principle (c): Data minimisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/), checked 9 October 2026).
3. Review accuracy, storage and security ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 9 October 2026).
4. Record the decisions and keep them under review ([ICO, Guide to accountability and governance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/), checked 9 October 2026).

## Common questions

### Does data minimisation mean collecting as little as possible?

It means collecting what is adequate, relevant and needed for the purpose. Too little information can also prevent the job being done properly ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5) and [ICO, Principle (c): Data minimisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/), checked 9 October 2026).

### Does good security cover all the principles?

No. Security is one part of the duty. You also need to address matters such as fair use, purpose, accuracy and how long data is kept, and be able to show how you do so ([ICO, A guide to the data protection principles](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/5), checked 9 October 2026).

## Where next

- [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md)
- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)
- [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md)

## Sources

- ICO, A guide to the data protection principles: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/ (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/5 (checked 9 October 2026)
- ICO, Principle (b): Purpose limitation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/ (checked 9 October 2026)
- ICO, Principle (c): Data minimisation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/ (checked 9 October 2026)
- ICO, Guide to accountability and governance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/ (checked 9 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.