Stage 5 summary. Privacy and protection

UK GDPR Article 6 requires a lawful basis to be identified and documented before processing begins, and it cannot be switched later when the first choice becomes inconvenient. ICO guidance sets out seven, since the Data (Use and Access) Act 2025 added recognised legitimate interests at Article 6(1)(ea) for a narrow list of purposes pre-approved in law, alongside consent, contract, legal obligation, vital interests, public task and legitimate interests. They are not a ladder: there is no hierarchy, so the purpose decides which applies.

Consent is weak in practice because it must be as easy to withdraw as to give, which makes it the wrong choice for processing the organisation intends to continue anyway. Contract covers delivering the order and does not stretch to behavioural advertising. Legitimate interests needs a documented balancing test and is closed to public authorities acting officially. One habit runs underneath all of it: date the claim, because adequacy decisions are renewed and Acts phase in, and a record carrying a decision date and the guidance version can be checked by whoever reads it next.

Moving personal data outside the UK or the European Economic Area needs adequacy or an appropriate safeguard, and the route is ordered rather than optional. Check adequacy first: the European Commission renewed the UK decisions on 19 December 2025. For a United States recipient, the EU-US Data Privacy Framework and the UK Extension, often called the UK-US data bridge, work only where that organisation is actively certified, eligible and covered for the data type, with extra conditions for human resources and special category data.

Otherwise the mechanism is Standard Contractual Clauses with the UK Addendum, or an International Data Transfer Agreement, plus a transfer risk assessment. That assessment exists because of Schrems II in July 2020: the clauses remain valid in principle, but the exporter must judge whether the recipient country's law lets the importer honour them, and encryption helps only where the importer holds no keys. The Irish regulator's 1.2 billion euro decision against Meta in May 2023 marks the cost of getting that wrong. The Commission's Digital Omnibus package of 19 November 2025 would adjust how the personal data definition applies to pseudonymised data, but a proposal binds nobody until the Parliament and the Council agree a text.

Strip the names, addresses and record numbers from a hospital admissions file and date of birth, postcode district, sex and diagnosis remain. Anyone holding a second file with those three fields and a name can put a name against a diagnosis by reading the two together. Those are the quasi-identifiers: values that identify nobody alone and almost everybody in combination, so removing the direct identifiers addresses the fields that were never the route in.

The ICO finalised its guidance on anonymisation, pseudonymisation and privacy-enhancing technologies on 28 March 2025 and treats identifiability as a spectrum, with the motivated intruder test to locate a release on it: someone competent, working from the internet and public records, with no prior knowledge and no privileged access, taking all reasonable steps. Run it, and record the answer with a date. Pseudonymisation is named in law as an appropriate technical measure, but the organisation holds the means to reverse it, so subject rights, retention limits, the lawful basis and breach duties all still apply. Tokenisation is the same control applied to one value.

k-anonymity groups records by their quasi-identifiers so that no group holds fewer than k, reached through generalisation and suppression, which cost analytical value and remove the rare rows a researcher wanted. Three limits matter more than the technique: a class where everyone shares a diagnosis discloses it without singling anyone out, k does not compose so two separately safe tables can isolate people when read together, and k is measured against auxiliary data that only accumulates.

Differential privacy asks instead whether the published output would look meaningfully different had any one person been absent, adding noise so that no individual's presence is detectable. The guarantee attaches to a person, so it holds against auxiliary data nobody has seen, and its cost is stated openly through the parameter epsilon and a privacy budget spent across every release. The 2020 United States Census is the reference deployment, whose TopDown Algorithm produced the Public Law 94-171 redistricting data on 12 August 2021, with the accuracy trade argued in public.

Read the rest of the family by what each one changes. Federated learning changes what has to move, and the model updates themselves leak, so it needs an output privacy approach beside it. Secure computation changes who has to be trusted, at high engineering cost. Trusted research environments change where the analysis happens, under the Five Safes, and clean rooms are the commercial cousin, judged on output controls and audit rather than the label.

Confidentiality, integrity and availability are worth weighting for a specific dataset rather than reciting. Payroll is dominated by confidentiality, where a leak damages every person in it and an hour of downtime is an inconvenience. A billing meter archive is dominated by integrity, where one corrupted reading produces an invoice that is legally wrong. A public timetable feed is dominated by availability and has almost no confidentiality requirement. UK law folds all three into the integrity and confidentiality principle, whose text reaches accidental loss and destruction.

Encryption at rest answers exposure of the stored bytes and encryption in transit answers interception across a pipeline's many hops, and neither stops the attack that actually takes the records, because a stolen analyst session arrives holding valid credentials and storage decrypts for it exactly as for a legitimate one. Encryption fails through key management rather than broken ciphers: keys stored beside the data, keys held entirely by the provider, no rotation, no revocation path, or a key destroyed without a tested recovery path. The questions that separate a control from a diagram are who can compel decryption, how quickly a key rotates, and what has been restored from an encrypted backup in a drill.

Role-based access control grants permissions through jobs, which makes review possible and makes a leaver lose everything at once, and it drifts, because adding a permission to an existing role is easier than arguing for a new one. Attribute-based control evaluates the requester, the data, the action and the context against a policy, so classification and purpose combine without a role for every permutation, at the cost of being harder to reason about. Most mature estates run both, with roles carrying the coarse grant and attributes the conditions.

Placement matters as much as model. Row level security attaches policies to the table so the database applies them to any query, and PostgreSQL shows the shape: deny by default once row security is enabled with no policy present, while superusers and roles holding BYPASSRLS sit outside the mechanism. Filtering in the reporting layer is a convention that disappears the moment a notebook connects to the warehouse. Masking and tokenisation then differ on reversibility: masking leaves no analytic utility in the value, while tokenisation keeps the mapping in a vault so joins survive, which relocates the secret rather than reducing the risk. Neither is anonymisation.

The storage limitation principle names no number, which is the most misunderstood thing about it. A retention schedule turns it into dated, assignable instructions, and four columns do the work: the class as a set of records with a shared purpose rather than a table, the clock start as a business event rather than a row creation timestamp, the disposition of deletion, anonymisation or archive, and the source of the period. A tax record runs from the end of the accounting period, and archive without a further clock quietly becomes an indefinite hold at a lower monthly bill.

A legal hold preserves documents relevant to proceedings and stops routine deletion for them. Practice Direction 57AD is explicit that the documents to be preserved include those that would otherwise go under a retention policy, and that the relevant deletion processes must be suspended. The detail most implementations get wrong is that a hold suspends the clock rather than restarting it, so a record five years into a six-year period, held for two years, is due one year after release. That needs a flag on a defined set of records rather than a global pause, and the same scoping answers erasure, since the Article 17 right does not apply where processing is necessary for legal claims.

Deleting the production row touches one of the places the record lives. An erasure request has to reach the master record, the copies in reporting, development and test, the derivations such as reports, indexes and feature stores, and finally the backups. Lineage answers where those copies are, and a team without it cannot state where a person's data is. Free-text notes turned into an embedding still represent that person and need their own deletion path, and no general operation removes one training example from a trained model.

Backups are hard because a point-in-time image is often immutable by design. ICO guidance says that where backup data cannot be immediately overwritten it must be put beyond use, must not be used for another purpose, and the individual must be told it may remain until replaced on the established schedule, which makes the backup cycle part of the answer given to them.

Defensible deletion claims that the process was designed, approved and followed, not that no copy survives anywhere. Four things have to hold: the rule existed beforehand in an approved schedule, it was applied to the whole class because selective deletion of inconvenient records is what turns a routine disposal into an adverse inference, holds were checked before the job ran, and the outcome was recorded as a deletion, a hold with its reason, or an exception with a review date. The audit log must survive the disposal under its own schedule.