The Principle Series: Lawfulness, Fairness & Transparency

The UK GDPR’s data protection principles are more than regulatory requirements – they are the foundation of good data handling practices. The first of these principles is lawfulness, fairness and transparency.

For charities, this principle carries particular significance, as it helps build trust with beneficiaries, donors, volunteers and other individuals whose personal information they handle.

The principle of lawfulness means that organisations must not do anything with personal information that breaks the law. While this may seem obvious, it goes beyond avoiding criminal offences. Processing data in a way that breaches confidentiality obligations, contractual terms or copyright law could also be considered unlawful.

A valid lawful basis must also be identified to process data – establishing the legal grounds for which data will be collected, stored, shared or used is important.

In practice, fairness means handling personal information in a way that aligns with individuals’ expectations and considering whether your processing could have an unjustified, detrimental impact on them.

And finally, organisations must be transparent about themselves and their processing, being clear about how and why they process data – this is linked to data subjects’ right to be informed.

Putting this principle into practice

• Ensure you have identified and recorded a lawful basis to process all data that is handled in your organisation. Special category data and criminal offence data require extra conditions to be considered lawfully processed too, so remember to establish those.
• Ensure that you are not misleading in any way when data is being obtained
• Ensure you handle data subject requests fairly and without conflict of interest
• Tell people about their rights and your processing clearly, in plain language, via a privacy notice

The benefits of getting it right

By making sure data processing is lawful and fair, and by being transparent from the very start, organisations can:

• Gain trust, confidence and strengthen stakeholder relationships – people are more likely to share their information if they understand how it will be processed and what their rights are
• Protect their reputation – commitment to fair and lawful practices may reduce the likelihood of complaints or disputes