At a glance
Data protection is the fair and proper use of information about people. It’s part of the fundamental right to privacy – but on a more practical level, it’s really about building trust between people and organisations. It’s about treating people fairly and openly, recognising their right to have control over their own identity and their interactions with others, and striking a balance with the wider interests of society.
It’s also about removing unnecessary barriers to trade and co-operation. It exists in part because of international treaties for common standards that enable the free flow of data across borders. The UK has been actively involved in developing these standards.
Data protection is essential to innovation. Good practice in data protection is vital to ensure public trust in, engagement with and support for innovative uses of data in both the public and private sectors.
The UK data protection regime is set out in the DPA 2018 and the GDPR (which also forms part of UK law).
Yes, if you have information about people for any business or other non-household purpose. The law applies to any ‘processing of personal data’, and will catch most businesses and organisations, whatever their size.
You will not need to comply if you only use the information for your own personal, family or household purposes – eg personal social media activity, private letters and emails, or use of your own household gadgets.
In short, personal data means information about a particular living individual. This might be anyone, including a customer, client, employee, partner, member, supporter, business contact, public official or member of the public.
It doesn’t need to be ‘private’ information – even information which is public knowledge or is about someone’s professional life can be personal data.
It doesn’t cover truly anonymous information – but if you could still identify someone from the details, or by combining it with other information, it will still count as personal data.
It only includes paper records if you plan to put them on a computer (or other digital device) or file them in an organised way. If you are a public authority, all paper records are technically included – but you will be exempt from most of the usual data protection rules for unfiled papers and notes.
The DPA 2018 sets out the framework for data protection law in the UK. It updates and replaces the Data Protection Act 1998, and came into effect on 25 May 2018.
It sits alongside the GDPR, and tailors how the GDPR applies in the UK - for example by providing exemptions. It also sets out separate data protection rules for law enforcement authorities, extends data protection to some other areas such as national security and defence, and sets out the Information Commissioner’s functions and powers.
The GDPR is the General Data Protection Regulation (EU) 2016/679. It sets out the key principles, rights and obligations for most processing of personal data – but it does not apply to processing for law enforcement purposes, or to areas outside EU law such as national security or defence.
The GDPR came into effect on 25 May 2018. As a European Regulation, it has direct effect in UK law and automatically applies in the UK until we leave the EU (or until the end of any agreed transition period, if we leave with a deal). After this date, it will form part of UK law under the European Union (Withdrawal) Act 2018, with some technical changes to make it work effectively in a UK context.
Making Tax Digital is a key part of the government’s plans to make it easier for individuals and businesses to get their tax right and keep on top of their affairs.
HMRC’s ambition is to become one of the most digitally advanced tax administrations in the world. Making Tax Digital is making fundamental changes to the way the tax system works – transforming tax administration so that it is:
Making Tax Digital for VAT
If you run a VAT-registered business with a taxable turnover above the VAT registration threshold (currently £85,000) you are required to keep digital VAT business records and send returns using Making Tax Digital (MTD)-compatible software. The vast majority of businesses need to do this for VAT periods that started on or after 1 April 2019. Businesses with a taxable turnover below the VAT threshold can also sign up for MTD for VAT voluntarily.
The MTD service for VAT is open to VAT businesses and their agents mandated to use it.
If you have an agent, you should speak to them to find out when it may be best for you to join MTD. It’s important that you have the appropriate software package, so if you already use accounting or record keeping software you should also speak to your software provider to find out when it will be updated for MTD.
If you are registered for VAT and your taxable turnover is above the VAT registration threshold (currently £85,000), you must keep digital business records and send your VAT returns to HMRC using MTD-compatible software. For the vast majority of businesses this applies to accounting periods that started on or after 1 April 2019.
If your taxable turnover has dropped below the VAT registration threshold at any point after 1 April 2019 you are still required to continue to keep digital records and send HMRC your VAT returns using MTD-compatible software. This obligation doesn’t apply if you de-register from VAT or if you are exempt from MTD for VAT.
For a small minority of businesses that have more complex requirements, we have made the decision to defer mandation by 6 months to ensure there is sufficient time for testing the service with them in the pilot before they are mandated to join. These businesses have until 1 October 2019 to start keeping records digitally and using MTD-compatible software to send their VAT returns to HMRC.
This applies to those that fall into one of the following categories: trusts, ‘not for profit’ organisations that are not set up as a company, VAT divisions, VAT groups, those public sector entities required to provide additional information on their VAT return (such as government departments and NHS Trusts), local authorities, public corporations, traders based overseas, those required to make payments on account and annual accounting scheme users.
Find out how to get ready for MTD for VAT if you’re a business.
If your business has a taxable turnover below the VAT threshold you can still sign up for MTD voluntarily. HMRC is encouraging businesses with a taxable turnover below the VAT threshold to sign up so they can also benefit from MTD. Businesses can also sign up for MTD for Income Tax. This means, subject to your business type, you can further streamline your business processes. You can read more about MTD for Income Tax further down.
Software will help you stay on top of business record keeping, allowing you (and your agent, if you have one) to better understand how your business is performing.
You will need to keep your business records digitally from the start of your accounting period. If you already use software to keep your business records, check your software provider’s plans to introduce MTD-compatible software.
If you don’t currently use software, or your software won’t be MTD-compatible, you’ll need to consider what software is suitable for your requirements.
Anyone using the service, whether they are mandated or want to join voluntarily, must sign up for it.
A spreadsheet can be used to calculate or summarise VAT transactions to arrive at the return information you need to send HMRC.
If you use spreadsheets to keep business records, you’ll need MTD-compatible software so that you can send HMRC your VAT returns and receive information back from HMRC. Bridging software may be required to make spreadsheets MTD-compatible. You can read what we mean by ‘bridging software’ below.
The information must not be physically re-typed into another software package.
MTD does not require you to keep additional records for VAT, but to record them digitally.
Your digital records should include, for each supply, the time of supply (tax point), the value of the supply (net excluding VAT) and the rate of VAT charged. They should also include information about your business, including business name and principle business address, as well as your VAT registration number and details of any VATaccounting schemes you use.
Compatible software is a software product or set of software products that between them support the MTD obligations of keeping digital records and exchanging data digitally with HMRC through the MTD service. If more than one application is being used, data that flows between those applications must also be exchanged digitally.
Digital records can be kept in a range of compatible digital formats. They do not all have to be held in the same place or on one piece of software. For example, a spreadsheet can be a component of digital record keeping provided the product that consolidates records, or summary records from the spreadsheet, can exchange data digitally with HMRC.
HMRC will give businesses until 31 March 2020 to make sure there are digital links between software products. Before that date, cut and paste will be an acceptable way to transfer information.