The UK's framework for how organisations must collect, store, and handle personal data — backed by law and enforced by the ICO.
Information Commissioner's Office
The Standard
UK GDPR and the Data Protection Act 2018 define the legal obligations every organisation must meet when handling personal data — here's what that covers and how it shapes the way we build and operate systems.
UK GDPR and the Data Protection Act 2018 are not optional frameworks organisations can choose to follow. They are law. Any organisation that collects, stores, or processes personal data about people in the UK must comply — with fines of up to £17.5 million or 4% of annual global turnover for serious breaches.
The legislation defines a set of binding principles: personal data must be processed lawfully, fairly, and transparently. It must be collected for specific, defined purposes and not used for anything else. It must be kept accurate, not held longer than necessary, and protected from unauthorised access.
The Information Commissioner's Office is the independent UK authority responsible for upholding data protection rights. The ICO investigates complaints, issues binding guidance, and imposes enforcement actions — including substantial fines and public reprimands that carry significant reputational consequences.
Why It Matters
Working with a technology partner that takes data protection law seriously has real, practical consequences for your business and your users.
When Black Opal processes personal data on your behalf — in an application, a data pipeline, or a hosted environment — that processing is governed by the same legal framework that governs yours. Compliance is not delegated; it is embedded in how we build.
Regulators hold data controllers responsible for the acts of their processors. Choosing a technology partner that treats data protection as a legal obligation — not a best-effort policy — reduces your exposure and demonstrates the appropriate due diligence your auditors expect.
End-users expect their data to be handled fairly and only for purposes they understand. When the applications Black Opal builds follow data minimisation, purpose limitation, and transparent processing principles, your users' trust in your product is better protected.
How We Operate
Compliance with data protection law is a legal obligation we take seriously across everything we build and operate. Here is what that looks like in practice.
Every application and system Black Opal builds is designed with data minimisation in mind. We collect only what a defined purpose requires, store it appropriately, and do not retain it beyond its useful life. These are not policies applied after delivery — they are decisions made at the design and build stage.
GDPR compliance is not a one-time exercise. We conduct regular reviews of how personal data is handled across our systems to confirm that processing remains lawful, that retention periods are observed, and that any changes in how data flows through an application are reflected in our documentation.
Where Black Opal acts as a data processor on behalf of a client — handling data that belongs to their users or their business — we operate under a data processing agreement that sets out both parties' obligations clearly. Our responsibilities under UK GDPR are formal, not informal.
Handling personal data carries legal responsibilities that apply to everyone who touches it — not just compliance roles. Our team is trained on their obligations under UK data protection law, and that awareness is part of how we work day to day.
Related Services
Data protection obligations run through every area of our work. These are the services where GDPR compliance is most directly relevant.
Applications built with data minimisation, lawful processing, and user rights at the design stage — not retrofitted after delivery.
AI systems that process personal data are subject to UK GDPR. We build with that in mind, from training data governance to inference pipelines.
Where data pipelines touch personal information, we build them to process only what is needed, for defined purposes, with appropriate retention controls.
Data in hosted environments is subject to the same legal protections. We design cloud architectures that enforce access controls, logging, and data boundary rules.
GDPR compliance considerations are built into our solution planning — not added as an afterthought when the architecture is already set.
Data protection literacy is part of how we approach training. Teams who understand their legal obligations handle data better every day.
Work With Us
Black Opal complies with UK GDPR and the Data Protection Act 2018 across everything we build and operate. If you'd like to understand how that applies to your specific project — whether that's a data processing agreement, an architecture review, or a question about how your users' data is handled — we're ready to talk.