EP NowStoreAcademySupportProduction LotProducts by Country
Legal & Compliance Home

The UK GDPR and how Productions can Reduce their Exposure - Q&A with Sheridans

Sheridans’ Associate Krishan Neelendra answers key UK GDPR questions from production companies and freelancers.
May 3, 2022
uk-gdpr-and-how-productions-reduce-exposure-LC

We recently teamed up with Sheridans Associate Krishan Neelendra to host a webinar on the UK GDPR, where he answered key questions from production companies and project freelancers.

Although the UK GDPR is not new, an increased need to collect special category data, such as vaccination and diversity data, means that compliance remains a key concern for the production industry. 

Q. How do I know whether the UK GDPR applies to my production company?

Krishan: The UK GDPR applies to your production company if you process personal data. “Process” is interpreted broadly under the UK GDPR and essentially means dealing with personal data in any way, including transferring, analysing or merely storing it. If you do any of these things, you’re caught by the UK GDPR.

Q. I outsource all data processing to my freelance production team — am I safe from liability under the UK GDPR?

Krishan: This depends on your relationship with your freelance production team and the processing activities you undertake. However, broadly, if you’re the decision maker in relation to the processing activities (i.e., the freelance production team is acting on your behalf and in accordance with your instructions), you are a data controller and the freelance production team is a data processor.

Data controllers are primarily responsible for their own compliance and ensuring the compliance of their processors. This means that, regardless of the terms of a contract with a processor, controllers may be subject to any of the corrective measures and penalties set out in the UK GDPR (e.g., claims for compensation from a data subject and administrative fines).

However, it should be noted that data processors can still be: 

  • Contractually liable to the data controller for a failure to comply with the applicable data protection terms
  • Fined by the data protection regulator (i.e., the Information Commissioner’s Office in the UK) 
  • Subject to a claim by an individual where they fail to comply with certain data processor-specific UK GDPR obligations or act outside the data controller’s lawful instructions

Q. How can I ensure that I’m UK GDPR compliant?

Krishan: There are a number of different considerations to consider but the three golden rules for data controllers are as follows:

  • Make sure that you’ve published and implemented the relevant documentation, contracts and policies.
  • When making any personal data-related decision, always consider the seven data protection principles set out in the UK GDPR.
  • Get used to documenting any incidents, projects and decisions relating to data protection. For example, if you’re planning a project that will involve processing a lot of personal data, assess this from a data compliance perspective as soon as possible so you know what safeguards you need to implement later on.

Q. Am I allowed to collect vaccination data and, if so, what are the rules?

Krishan: Vaccination data constitutes “health data” and is therefore special category data. While the requirements largely depend on the context in which this data is collected, you should in any case: 

  • Consider whether you have a lawful basis and special condition (essentially a legal and valid justification) under data protection laws to collect the data
  • Only collect the data from individuals who you reasonably require it from 
  • Tell individuals you are collecting the data (e.g., via privacy notices and appropriate policy documents) 
  • Appropriately safeguard the data (e.g., through appropriate access controls and encryption)
  • Delete or destroy the data as soon as you no longer need it

Q. What special requirements apply to capturing diversity data?

Krishan: The requirements for capturing diversity data are largely the same as for vaccination data (above), but the analysis in relation to lawful basis and special conditions will be slightly different. The key thing to bear in mind is that you must determine a valid and legal justification for processing the data.

Q. I have fewer than 250 employees. If I carry out a one-off diversity survey, do I have to document the processing of that data?

Krishan: All personal data processing activities, regardless of the nature of the personal data, trigger certain documentation requirements. For example, you must tell the relevant individuals how you are using (or “processing”) their personal data in a privacy notice.

When carrying out a one-off diversity survey, as you are processing special category data, some additional requirements apply. In particular, you must prepare a separate “appropriate policy document” (which must set out certain information about how you are processing the special category data in accordance with data protection laws).

Q. I’m collecting data to monitor the diversity of my production, including around disabilities and caring responsibilities. These aren’t listed as types of special category data — do they count as such?

Krishan: Disability data concerns an individual’s health and therefore constitutes special category data.

In relation to caring responsibilities, while the fact that an individual is a carer is unlikely to constitute special category data, if the data reveals that an individual is a carer for a specific person (e.g., a parent or partner), it may constitute special category data of the person being cared for (depending on how the relevant information is provided). If this is the case, and you don’t reasonably require this information, your survey should avoid any invitation to provide this information (e.g., by limiting the response to the question “are you a carer for another individual?” to a simple yes/no).

Q. What is a data subject access request?

Krishan: Data subject access requests are an example of data subject rights under the UK GDPR. Effectively, any data subject can ask a company to provide them with all the information it holds about them, subject to certain limited exemptions. In recent years, there’s been an increase in the number of data subject access requests. They tend to arise in two contexts: 

  • A pre-litigation context, where a data subject may want to sue someone and is gathering information before doing so
  • A grievous employee context, where an employee has left a business and is gathering information about why they were dismissed or why certain decisions were made before taking their case to an employment tribunal

It’s important to remember that there are no formality requirements for data subject access requests. You can receive requests by phone or text and they don’t have to include the words “data subject access request.” 

Please note that the responses in this document do not constitute legal advice. If you require legal advice on any of these points, we recommend that you seek this independently.

Topic: UK

Related Content

Fully Focused-Thumbnail-480

Entertainment Partners and Fully Focused Partner to Support the Future of UK Production

5/7/2024
New partnership aims to foster the next generation of UK production professionals and break down barriers...
More
EP Blog-Bob Clarke-Mama Youth

Celebrating (Almost) 20 Years of MAMA Youth Project

4/17/2024
UK charity’s founder, Bob Clarke, shares how this unique initiative is breaking down barriers to...
Woman looking at a laptop

20 IR35 Terms Every Production Worker Should Know

5/28/2024
Find out how to apply the UK’s IR35 rules to your film and TV productions with this helpful overview.
Master Series Thumbnail–UK indie film tax credit

Boost Your Budget with the Independent Film Tax Credit

5/9/2024
Learn how to maximize UK incentive dollars with the new IFTC!

Spotlight: Lloyd Gunton, UK Tax Credit Expert

5/7/2024
Meet the creative sector tax expert helping EP clients from indies to major studios maximize incentives...
Cameraman filming outside in a field

HMRC Announces Changes to Claiming UK Creative Sector Tax Incentives

4/26/2024
What productions should know about the increased disclosure requirements under the UK's Audio-Visual...
Producer and actor standing on a film set

How to Prepare for an Audit: Tips for UK Productions

4/16/2024
Discover key strategies UK film and TV production companies can use to effectively prepare for an audit.
Topic: UK
More
Camera man and production crew on a film set

Curious About Co-productions? What Producers Need to Know.

4/9/2024
Discover the advantages, requirements, and strategies for successful co-productions in the film industry.
National Film and Television School

Entertainment Partners To Provide Funding For Future Assistant Directors And Floor Managers

3/28/2024
Two new scholarship opportunities are now available for those looking to train in the field of assistant...

What Does the UK’s New Independent Film Tax Credit (IFTC) Mean for Productions?

3/7/2024
As the UK government strengthens its support for productions, find out what the latest changes to the...
SB 1162-thumbnail-blue

SB 1162: California Pay Data Reporting Law FAQs

2/17/2024
A look at California’s new expanded pay data reporting law and its impact on the entertainment industry.
Topic: Legal
More
Four panelists discuss co-production-square

Unlocking the Myths and Benefits of Co-Production

2/15/2024
Learn the difference between an official co-production and PSA, and how to leverage these opportunities to...
EP Newsroom-Thumbnail-PGGB

Million Youth Media Wins The Duke of Edinburgh Film & TV Inclusion Award 2024 at PGGB Talent Showcase

2/14/2024
The Duke of Edinburgh Film & TV Inclusion Award presented to Million Youth Media, an organisation offering...

California Pay Data Reporting Law Updates and Resources

2/8/2024
California recently made significant revisions to the State's pay wage reporting requirements. Get to know...
Topic: Legal
More
Sundance 2024-Square

Supporting WIF and Diversity Submissions at Sundance

2/1/2024
A long-time advocate of diversity, inclusion, and female empowerment in the film industry, Entertainment...
Blue square with white letters and UK flag: Changes to UK Paternity Leave Regulations

Changes to UK Paternity Leave Regulations

1/19/2024
Effective March 8th, modified paternity leave to provide more flexibility for UK fathers.
Topic: Alerts
More
Big Ben, London

5 Things to Consider Before Transitioning to the UK’s New AVEC Regime

1/16/2024
A comprehensive overview to help determine if you should use the UK’s new incentive regime to fund your...
Blue tile stating UK announces minimum wage updates

UK Government Announces Minimum Wage Updates

12/5/2023
National Living Wage and National Minimum Wage rates increase for 2024.
Master Series Thumbnail Square UK Productions

UK Production: Sites, Services and Studios

10/20/2023
Learn about UK incentives, infrastructure and production innovation spanning from London to Wales,...

Entertainment Partners Makes Commitment to UK Production with Film & TV Partnership Programme

10/12/2023
Find out how EP is partnering with the leading UK training organisations to close the skills gap, increase...
Entertainment Partners Logo Thumbnail-square

NFTS and Entertainment Partners (EP) Establish Partnership to Support the Future of Film and Television Production

10/5/2023
By supporting the National Film and Television School through this new partnership, Entertainment Partners...
Newsroom-Advanced-Television-Logo-Thumbnail

NFTS, Entertainment Partners establish partnership

10/5/2023
EP the entertainment payroll and production technology company joins as a prominent new Patron of the...
British-Cinematographer-Logo-Thumbnail

NFTS and Entertainment Partners (EP) establish partnership

10/5/2023
The National Film and Television School (NFTS) announces a new partnership with Entertainment Partners...
UK Right to Work Penalties to Triple in 2024

UK Right to Work Penalties to Triple in 2024

9/26/2023
Find out how your production can prepare for the increased penalties for employing a worker who doesn't...
Topic: Legal
More
EP Blog_SQUARE_Spread of UK Production

Outside of London: How the UK Production Industry Spread Beyond the Capital

9/21/2023
Film and TV production outside of London (OOL) is now an integral part of the UK, with world-class media...
Topic: UK
More
Expert Advice_Sam Collett

Spotlight: Sam Collett, UK Production Accounting and Incentives Expert

9/19/2023
Meet the Senior Partner at FLB Accountants, an Entertainment Partners company specializing in UK media and...
Master Series_UK Incentives Panel_Square

What's Changing in UK Production Incentives

9/15/2023
Learn about the recent changes to the UK Creative Sector Tax Credits and how they might impact your next...
EP Blog_SQUARE_UK cultural test

Understanding the UK Cultural Test

9/12/2023
Find out whether your film or TV show will pass the UK’s Cultural Test, a key step in qualifying for the...
EP Blog_SQUARE_EP Paymasters

Meet the Paymasters

9/5/2023
This National Payroll Week we celebrate the hard-working payroll professionals behind Hollywood's...

Payroll & Finances

PayrollResidualsSmartStartSmartTimeProduction PortalEP On LocationSmartAccountingEP LiveSmartPOCASHétPayPaymaster Rate GuideEP ResidencyMoneypenny

Manage Multiple Productions

AssetHubSmartHub

Additional Services

Academy
Subscribe now

Be an industry insider with EP's
newsletters and alerts

LegalPrivacy NoticeSecurity
© 2024 Entertainment Partners. All rights reserved.