Data Protection

Question 1

What constitutes personal data?

Answer 1

Any data relating to a natural person which can be used to directly or indirectly identify them

Question 2

What is the maximum penalty for a breach of the Data Protection Act / GDPR?

Answer 2

4% of global turnover or £17.5m

Question 3

What are the three key categories of people under GDPR?

Answer 3

Controller - the entity responsible for determining the purpose and means of processing personal data.

Note - can also be a joint controller - i.e. an RICS Regulated managing agent with leaseholders information is bound by the RICS Professional Regulations and so is a joint controller.

Processor - an entity with responsibility for processing personal data under instruction from the Controller.

Data processors do not have the same level of GDPR compliance responsibilities as controllers.

Controllers have the strictest level of responsibility for GDPR. Note - employees are treated as agents for the controller.

Data Protection Officer - internal person required within public authorities or organisations who regularly process data, or sensitive data