Minimise at source
Use high-level descriptions initially. Define the purpose and select only material needed for an agreed assessment or transfer.
Our assessment principles
De-identify where possible
Plan removal of identifiers before transfer where possible. Pseudonymised data can still be personal data; removing names alone does not establish anonymity.
Exclude special-category data
Our proposed scope excludes special-category data. Identify sensitive content, attachments and free text early, with a process to filter and review it.
Questions to resolve before transfer
- Authority and rights: who controls the data and what contractual or third-party restrictions apply?
- Lawful basis and fairness: what basis supports the proposed processing, and what information must affected people receive?
- DPIA: does the proposal require a data protection impact assessment, and who owns it? We can help scope the work with your adviser.
- Roles and terms: who acts as controller or processor, for what purposes, for how long, and with which deletion obligations?
- Transfers and security: where will data go, who can access it and what safeguards, access controls and incident arrangements apply?
- Rights and retention: how will requests, objections, correction and deletion be managed across the parties?
A boundary, not a badge
“UK GDPR-first” describes our approach; it is not a certification or a guarantee that a particular dataset can be shared. We support the assessment and coordination. Qualified legal and privacy advisers should review the proposed arrangement before you approve a transfer.
Please do not send raw data, special-category information, passwords, message exports or videos through our contact route.