Personal data law: GDPR, UK GDPR and US state laws

A controller decides why and how personal data is used, like the owner of a site with a form. Each field needs a purpose, a lawful basis and a retention period.

A caveat before we start

This lesson is a guide, and its text is dated 30 October 2026. Data protection law changed in recent years (the UK’s Data (Use and Access) Act 2025 amended the UK GDPR, and US states keep adding laws) and it will change again. It’s general information, not legal advice. It explains what to ask, not what to answer: for a real site a lawyer checks the final texts and the order of actions, and you read the current wording of each law yourself through the links at the end. Where an article is named below, you can find it in the text of the law. Where it says “in practice,” that’s an interpretation which is common today, not the letter of the law. For questions about your own site, ask a data protection lawyer, or the authority itself: the Information Commissioner’s Office (ICO) in the UK, your national data protection authority in the EU, the California Privacy Protection Agency (CPPA) in California.

Why this is about you

In the lesson on privacy by design you saw the main thing already: if a site collects a name and a phone number, you’re working with personal data. Here is the same question from the legal side.

There are three bodies of law in this course for English speakers, and they differ in shape:

• The GDPR (the General Data Protection Regulation of the European Union, Regulation 2016/679) is one law for the whole EU, with one set of rules for almost every organization that handles personal data.
• The UK GDPR, together with the Data Protection Act 2018, is the United Kingdom’s own copy since it left the EU. It’s almost the same in structure. The regulator is the ICO.
• The United States has no single federal privacy law for ordinary websites. Instead there are laws for particular sectors (health, children, banks) and, now, a patchwork of state laws. California’s Consumer Privacy Act (CCPA, as changed by the CPRA) is the best known. By one count, 24 states had a comprehensive privacy law by late October 2026, and counts differ with the date and the source.

The first words of the GDPR (Article 4):

• Personal data is any information relating to an identified or identifiable natural person. A name, a phone number, an email, an address, a photo, an online identifier. Information about an organization (its name and number) isn’t personal data, but its employee’s name and work email are.
• Processing is any operation performed on personal data: collecting, recording, storing, using, sending, deleting. Just receiving an inquiry and keeping it in your inbox is processing.
• A controller is the one who, alone or with others, determines the purposes and means of processing. If the form on your site collects names, you’re the controller, whether you’re a sole trader, a freelancer or a company. The law doesn’t apply to purely personal or household activity (an address book of friends), but a site with a customer form isn’t that.
• A data subject is the person whose data is processed: your visitor.
• A processor is whoever processes personal data on behalf of the controller: a form service, an email provider, a CRM. You remain responsible to the person.

Does it apply to me?

It depends on whom you serve, not only on where you sit.

• The GDPR applies if you’re established in the EU, and also, under Article 3(2), if you’re outside the EU but offer goods or services to people in the EU (payment or not) or monitor their behavior there. A site that a few Europeans happen to open doesn’t become subject to the GDPR for that reason alone. A site with prices in euros, shipping to EU countries and a language chosen for them does look like “offering.”
• The UK GDPR works the same way for the UK.
• The CCPA applies to for-profit businesses doing business in California that meet any one of three tests: annual gross revenue above $26,625,000 (the figure adjusted for inflation from 1 January 2025), buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50 percent or more of annual revenue from selling or sharing it. Many small sites fall below all three. Other states have thresholds of their own, usually by the number of residents whose data you process.

A small site below every American threshold can still face the GDPR if it targets Europeans, and a good habit helps everywhere: the habits below make you compliant with the strictest law you’re likely to meet, and cost almost nothing on a small form.

Three questions for every field

Article 5 of the GDPR lists the principles: lawful, fair and transparent; limited to specified purposes; no more data than needed (data minimization); accurate; kept no longer than necessary; kept secure; and the controller can show that it complies (accountability). You laid the purpose and the retention into your database schema in the lesson on privacy by design; the law adds the lawful basis. For a form this turns into three questions about each field:

1. Why? The purpose is named in advance and specifically. “Call back about the inquiry” is a purpose; “for marketing” is not. What the purpose doesn’t need isn’t collected: a date of birth “just in case” isn’t a purpose.

2. On what basis? Article 6(1) lists six lawful bases. For a small site, four matter:

   • consent of the person for one or more specific purposes;
   • contract: processing necessary to perform a contract with the person, or to take steps at their request before entering into one;
   • legal obligation: for example, tax and accounting records;
   • legitimate interests of the controller or a third party, unless the interests or fundamental rights of the person override them (a balance you must be able to explain).

   The other two are vital interests and public task. Consent isn’t the default. For an inquiry form the “steps at the request of the person before a contract” basis or legitimate interests often fit and are honest, and consent is needed where the law demands it (a newsletter, non-essential cookies: see the next lessons). In practice, pick the basis that’s true, because the person can withdraw consent at any time, and then you must stop.

3. How long? The period is written as a number with a condition for deletion (“three years after the last contact, then I delete”). Data with no period piles up forever.

When you have these three answers for every field, you have a record. From it come the privacy notice, the consent text and the answer to a lawyer.

Check yourself: which three questions do you ask of every form field?

Why you want it (the purpose), on what basis (consent, contract, legal obligation, legitimate interests) and how long you keep it (the period and the deletion).

Consent

When you do rely on consent, the GDPR defines it (Article 4(11)) as a freely given, specific, informed and unambiguous indication of the person’s wishes, by a statement or a clear affirmative action. Article 7 adds conditions. For a form this means:

• the person takes the action: they check a box that starts empty. A pre-checked box, “by pressing the button you agree,” and silence aren’t consent (Recital 32 says so about pre-checked boxes and silence);
• they see what exactly they agree to: who the controller is, which data, for what;
• you must be able to demonstrate that consent was given (Article 7(1)): the date, the version of the text, the purpose. You did this in the privacy by design lesson by recording consent as a fact;
• a request for consent made inside a longer text must be clearly distinguishable from the other matters, in plain language (Article 7(2)). Don’t bury it inside the terms of sale;
• consent can be withdrawn at any time, and it must be as easy to withdraw as to give (Article 7(3));
• it’s not “freely given” if you make a service depend on consent that it doesn’t need;
• a newsletter is a separate purpose and its own consent (you saw the email rules in the email lesson; the rules on advertising messages are in the lesson on advertising law; the next lessons cover cookies and ePrivacy).

How to say all this in plain words in a form, you practiced in the lesson on legal and expert texts. How to build it in markup, you do in the next lesson.

People’s rights

Under the GDPR a person has the right to be informed (Articles 13 and 14), to access their data (15), to have it corrected (16), erased (17), restricted (18), to take it with them (portability, 20), to object (21) and to withdraw consent (7(3)); and to complain to the supervisory authority and go to court. A request must be answered without undue delay and in any event within one month; the period may be extended by two further months where necessary, with notice to the person within the first month (Article 12(3)). It’s normally free (Article 12(5)). The UK GDPR keeps the same rights and times. In California, under the CCPA a consumer has the right to know, delete and correct, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information and to non-discrimination. A business confirms a request within 10 business days and responds within 45 calendar days, which it may extend by another 45 days with notice.

So the privacy notice must give an address to write to, and you need a process: who reads that mailbox, and what is done on a request to delete (including copies and logs, as in the privacy by design lesson).

What the controller must do

The main duties of the owner of a site with a form. Each one comes with its place in the law, so you can find and read it.

• A privacy notice. When you collect data, tell the person who you are, why you process the data, on what basis, who receives it, how long you keep it, what their rights are and how to complain (Article 13). How to write it, in the next lesson.
• Contracts with processors (Article 28). The processing by a processor is governed by a contract that says, among other things, that the processor acts only on your documented instructions, keeps the data secure, uses sub-processors only on conditions, helps with people’s requests and deletes or returns the data at the end. Most form services, email providers and analytics tools offer standard terms (a “data processing addendum”) to sign or accept.
• Records of processing (Article 30). Organizations with fewer than 250 people are exempt from keeping formal records unless the processing is likely to risk people’s rights, isn’t occasional, or includes special category data. A site that regularly receives inquiries is “not occasional,” so in practice write the record anyway. It’s the table you build in the practice below.
• Security (Article 32): measures proportionate to the risk. For a small site these are what you did in the lesson on site security and the lesson on form security: updates, passwords, HTTPS, input checks, access by role.
• Special category data (Article 9): health, political or religious views, trade union membership, sexual orientation, biometric and genetic data. Processing it needs an additional condition. If your form doesn’t ask for it but a person writes it in a free field, that is your problem: hint that extras shouldn’t be written and delete what arrives. For lawyers and expert witnesses, professional confidentiality adds to this (and in the US, an attorney’s duty of confidentiality, for example ABA Model Rule 1.6, is stricter than the privacy law).
• Transfers outside the UK or EEA (Chapter V, Articles 44 to 49). Personal data may leave only under a mechanism: an adequacy decision for the country (Article 45), appropriate safeguards such as the standard contractual clauses (Article 46), or a narrow exception. The EU–US Data Privacy Framework, adopted in July 2023, lets data go to certified US companies; the General Court upheld it in September 2025 and an appeal is pending, so check the current position. The UK has equivalent tools (the International Data Transfer Agreement and Addendum, and the “UK–US data bridge”).
• Registration. The GDPR removed the general duty to notify a regulator before processing. In the UK, however, most organizations that use personal data must pay the ICO a data protection fee each year unless exempt, and an organization outside the EU that falls under Article 3(2) may need to appoint a representative in the EU (Article 27). The US has no federal registration, though a few states ask data brokers to register.
• Breaches (Articles 33 and 34). A personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours after you became aware of it, unless it’s unlikely to result in a risk to people. If the risk is high, you must also tell the people. Every breach is documented (Article 33(5)). In the US, all fifty states have breach notification laws with their own deadlines and triggers.

Open the diagram, check what your site has, and see which duties follow.

Check what your site has. The map shows which duties of a controller of personal data follow. This is a teaching map as of 30 October 2026, not legal advice: the laws change.

• Inquiry form (name, phone)
• Analytics counter (for example Google Analytics)
• Session recording (for example Hotjar or Microsoft Clarity)
• Third-party chat widget hosted abroad
• Newsletter
• Customer account or login
• Payment on the site
• A third-party form service or CRM receives the inquiries
• In the “Message” field people describe their case, health or family
• Photos of people on the site

Nothing checked: the site knows nothing about people, so there are no personal data duties.

Text alternative: the diagram links ten things a site may do (a form, an analytics counter, session recording, a chat hosted abroad, a newsletter, an account, payment, a third-party form receiver, free text about a case, photographs) with the duties of a controller: decide purposes and bases, get consent where needed, publish a privacy notice, check registration, know where data is stored, handle transfers abroad, sign processor contracts, get separate consent for marketing email, treat special categories with care, and be ready for a breach.

Check yourself: a third-party service receives the form. Whose duties are they?

You’re still the controller: the service processes the data on your instructions. You need a processor contract, you need to know where the data is stored, and you name the service in the privacy notice.

Fines and enforcement

The GDPR sets two tiers of administrative fines (Article 83): up to 10 million euros or 2 percent of worldwide annual turnover, and up to 20 million euros or 4 percent, whichever is higher. The UK GDPR has £8.7 million or 2 percent, and £17.5 million or 4 percent (section 157 of the Data Protection Act 2018). In California the CCPA allows administrative fines of up to $2,663 per violation and $7,988 per intentional violation or one involving consumers the violator knows are under 16 (the amounts as adjusted from 1 January 2025). Regulators fine small organizations too, but the largest fines go to the biggest ones, and a complaint from a single person is how most cases begin. These are maximums, not a price list.

Russia, for comparison

This textbook began in Russia, and it’s useful to see how the same questions are answered there. Russia’s Federal Law No. 152-FZ “On Personal Data” also defines personal data, an “operator” (the counterpart of a controller), the lawful bases and consent. Three of its rules are different in kind from the GDPR’s. First, the operator generally notifies the regulator, Roskomnadzor, before processing. Second, when collecting the personal data of Russian citizens, the recording, accumulation and storage of the primary data must be done in databases located in Russia (Article 18, part 5): that is data localization, the strictest answer to the question of transfers, where the GDPR instead allows transfers under conditions (the infrastructure lesson shows what that means for choosing a provider). Third, the deadlines for a leak are shorter: the operator reports to Roskomnadzor within 24 hours and sends the results of an internal investigation within 72 hours. These details come from the Russian edition of this lesson and change often, so for a Russian audience read the current law.

What changed lately

Text on the internet goes out of date faster than the law. Some things to know on 30 October 2026:

• UK: the Data (Use and Access) Act 2025 amended the UK GDPR and the Data Protection Act 2018, and its main data protection provisions were brought into force in early 2026. Check the ICO’s current guidance.
• EU–US transfers: the Data Privacy Framework stands for now, with an appeal pending before the Court of Justice.
• United States: more states keep passing privacy laws, and California’s regulations on automated decision-making and risk assessments are phasing in.

For an expert’s site

An expert’s site (a lawyer, an expert witness, a surveyor) receives in its form more than a name and a phone number: people often describe their case. It can include health, family matters, criminal history and information about other people who haven’t agreed to anything. What to do: say in a hint that details are not needed, collect only what is needed for the first contact, continue the conversation through a secure channel, and remember professional confidentiality. A lawyer’s duty of confidentiality is stricter than data protection law, and a message sent through a website form may not be covered by privilege until a client relationship exists.

Practice

You’re in the era of 2022: the site stores inquiries and connects services. Draw up the record of processing for your project’s form: the controller, the source, the purposes, bases and retention periods of each field, where the data is stored, the services that receive it, special category data, and your decision on registration and fees.

The check reads the structure: that every cell is filled in, that the periods have numbers, that storage names a country or region, and that there are at least two services. It can’t judge whether your decisions are right. As in the earlier lessons, show the final version to a lawyer.

What used to be different

Europe’s first data protection law, the Directive of 1995, left each country to write its own, and the GDPR (adopted in 2016, applying since 25 May 2018) replaced it with one regulation. Before that, many sites collected data with no policy and no consent, and inquiries piled up in the owner’s personal mailbox. In the United States the story went another way: California passed the CCPA in 2018 (in force in 2020, extended by the CPRA in 2023), and other states followed one at a time. The practice today is to treat data as someone else’s property kept in trust: write down why you took it, don’t take extra, and return or destroy it on time.