{
 "name": "UK data law on passing on agent logs with personal data",
 "title": "UK data law on passing on agent logs with personal data",
 "kind": "terms-board",
 "url": "https://sellagentlogstoai.com/datasets/agent-log-uk-data-law/",
 "csv": "https://sellagentlogstoai.com/datasets/agent-log-uk-data-law.csv",
 "markdown": "https://sellagentlogstoai.com/datasets/agent-log-uk-data-law/index.md",
 "computed_at": "2026-10-28",
 "license": "https://sellagentlogstoai.com/terms",
 "headline": "5 provisions of UK GDPR and the Information Commissioner's guidance on reusing personal data that agent logs hold, each quoted from legislation.gov.uk or ico.org.uk, read 28 October 2026.",
 "quotes": [
  "5 provisions of UK GDPR and the Information Commissioner's guidance on reusing personal data that agent logs hold, each quoted from legislation.gov.uk or ico.org.uk, read 28 October 2026.",
  "What the provision settles, by provision: what a processor holding data for a customer may and may not do with it 2 of 5, when personal data may be used for a purpose other than the one it was collected for 1 of 5, the lawful bases for using personal data 1 of 5, the principles every use of personal data must meet 1 of 5 (5 provisions, read 28 October 2026).",
  "What it asks before the logs move, by provision: a new purpose compatible with the original one 2 of 5, the customer's documented instruction, as controller 2 of 5, a lawful basis for the new use 1 of 5 (5 provisions, read 28 October 2026).",
  "The rule, in its words, by provision: stated 5 of 5 (5 provisions, read 28 October 2026)."
 ],
 "citation": "\"UK data law on passing on agent logs with personal data\", updated 2026-10-28, https://sellagentlogstoai.com/datasets/agent-log-uk-data-law/.",
 "national": {
  "n": 5,
  "unit": "provisions",
  "documents": 5,
  "published_sources": 5,
  "named_sources": 5
 },
 "board": {
  "type": "clauses",
  "noun": {
   "one": "provision",
   "many": "provisions"
  },
  "document": {
   "one": "page",
   "many": "pages"
  },
  "fields": [
   {
    "id": "principle",
    "label": "What the provision settles",
    "counts": {
     "processor": 2,
     "principles": 1,
     "lawful-basis": 1,
     "further-use": 1
    },
    "values": [
     {
      "value": "principles",
      "text": "the principles every use of personal data must meet"
     },
     {
      "value": "lawful-basis",
      "text": "the lawful bases for using personal data"
     },
     {
      "value": "further-use",
      "text": "when personal data may be used for a purpose other than the one it was collected for"
     },
     {
      "value": "processor",
      "text": "what a processor holding data for a customer may and may not do with it"
     }
    ]
   },
   {
    "id": "step",
    "label": "What it asks before the logs move",
    "counts": {
     "controller-instruction": 2,
     "compatibility": 2,
     "lawful-basis": 1
    },
    "values": [
     {
      "value": "lawful-basis",
      "text": "a lawful basis for the new use"
     },
     {
      "value": "compatibility",
      "text": "a new purpose compatible with the original one"
     },
     {
      "value": "controller-instruction",
      "text": "the customer's documented instruction, as controller"
     }
    ]
   },
   {
    "id": "words",
    "label": "The rule, in its words",
    "counts": {
     "stated": 5
    },
    "values": [
     {
      "value": "stated",
      "text": "stated"
     }
    ],
    "clause": true
   }
  ],
  "lead": {
   "type": "count",
   "field": null,
   "value": null,
   "n": 5,
   "of": 5,
   "label": "UK provisions read on reusing personal data in agent logs"
  },
  "vendors": [
   {
    "name": "ICO on processors acting outside instructions",
    "answers": {
     "principle": {
      "value": "processor",
      "text": "what a processor holding data for a customer may and may not do with it",
      "documents": [
       {
        "document": "ICO guidance page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-a-processor/",
        "value": "processor",
        "quote": "If you act outside your instructions or process for your own purposes, you will step outside your role as a processor and become a controller for that processing."
       }
      ]
     },
     "step": {
      "value": "controller-instruction",
      "text": "the customer's documented instruction, as controller",
      "documents": [
       {
        "document": "ICO guidance page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-a-processor/",
        "value": "controller-instruction",
        "quote": "you can only process the personal data on instructions from a controller (unless otherwise required by law)."
       }
      ]
     },
     "words": {
      "value": "stated",
      "text": "If you act outside your instructions or process for your own purposes, you will step…",
      "documents": [
       {
        "document": "ICO guidance page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-a-processor/",
        "value": "stated",
        "quote": "If you act outside your instructions or process for your own purposes, you will step outside your role as a processor and become a controller for that processing."
       }
      ]
     }
    }
   },
   {
    "name": "UK GDPR Article 28, processors",
    "answers": {
     "principle": {
      "value": "processor",
      "text": "what a processor holding data for a customer may and may not do with it",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/28",
        "value": "processor",
        "quote": "processes the personal data only on documented instructions from the controller"
       }
      ]
     },
     "step": {
      "value": "controller-instruction",
      "text": "the customer's documented instruction, as controller",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/28",
        "value": "controller-instruction",
        "quote": "processes the personal data only on documented instructions from the controller"
       }
      ]
     },
     "words": {
      "value": "stated",
      "text": "if a processor infringes this Regulation by determining the purposes and means of…",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/28",
        "value": "stated",
        "quote": "if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing."
       }
      ]
     }
    }
   },
   {
    "name": "UK GDPR Article 5(1)(b), purpose limitation",
    "answers": {
     "principle": {
      "value": "principles",
      "text": "the principles every use of personal data must meet",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
        "value": "principles",
        "quote": "for specified, explicit and legitimate purposes and not further processed"
       }
      ]
     },
     "step": {
      "value": "compatibility",
      "text": "a new purpose compatible with the original one",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
        "value": "compatibility",
        "quote": "in a manner that is incompatible with"
       }
      ]
     },
     "words": {
      "value": "stated",
      "text": "for specified, explicit and legitimate purposes and not further processed",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
        "value": "stated",
        "quote": "for specified, explicit and legitimate purposes and not further processed"
       }
      ]
     }
    }
   },
   {
    "name": "UK GDPR Article 6(1), lawful bases",
    "answers": {
     "principle": {
      "value": "lawful-basis",
      "text": "the lawful bases for using personal data",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
        "value": "lawful-basis",
        "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies:"
       }
      ]
     },
     "step": {
      "value": "lawful-basis",
      "text": "a lawful basis for the new use",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
        "value": "lawful-basis",
        "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies:"
       }
      ]
     },
     "words": {
      "value": "stated",
      "text": "processing is necessary for the purposes of the legitimate interests pursued by the…",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
        "value": "stated",
        "quote": "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data"
       }
      ]
     }
    }
   },
   {
    "name": "UK GDPR Article 8A, further processing",
    "answers": {
     "principle": {
      "value": "further-use",
      "text": "when personal data may be used for a purpose other than the one it was collected for",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/8A",
        "value": "further-use",
        "quote": "of whether processing of personal data by or on behalf of a controller for a purpose (a “new purpose”) other than the purpose for which the controller collected the data (“the original purpose”) is processing in a manner compatible with the original purpose."
       }
      ]
     },
     "step": {
      "value": "compatibility",
      "text": "a new purpose compatible with the original one",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/8A",
        "value": "compatibility",
        "quote": "In making the determination, a person must take into account, among other things—"
       }
      ]
     },
     "words": {
      "value": "stated",
      "text": "any link between the original purpose and the new purpose;",
      "documents": [
       {
        "document": "legislation.gov.uk revised text",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/8A",
        "value": "stated",
        "quote": "any link between the original purpose and the new purpose;"
       }
      ]
     }
    }
   }
  ]
 },
 "subject_kind": "provision",
 "rows": [
  {
   "subject": "ICO on processors acting outside instructions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-a-processor/",
   "document": "ICO guidance page",
   "question": "principle",
   "answer": "processor",
   "answer_text": "what a processor holding data for a customer may and may not do with it",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "If you act outside your instructions or process for your own purposes, you will step outside your role as a processor and become a controller for that processing.",
   "text_sha256": "1d5afc06152a70195b0a1a83d1fbf35d7516299e82c2d43b4a80fc7082abe1ad"
  },
  {
   "subject": "ICO on processors acting outside instructions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-a-processor/",
   "document": "ICO guidance page",
   "question": "step",
   "answer": "controller-instruction",
   "answer_text": "the customer's documented instruction, as controller",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "you can only process the personal data on instructions from a controller (unless otherwise required by law).",
   "text_sha256": "1d5afc06152a70195b0a1a83d1fbf35d7516299e82c2d43b4a80fc7082abe1ad"
  },
  {
   "subject": "ICO on processors acting outside instructions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-a-processor/",
   "document": "ICO guidance page",
   "question": "words",
   "answer": "stated",
   "answer_text": "If you act outside your instructions or process for your own purposes, you will step…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "If you act outside your instructions or process for your own purposes, you will step outside your role as a processor and become a controller for that processing.",
   "text_sha256": "1d5afc06152a70195b0a1a83d1fbf35d7516299e82c2d43b4a80fc7082abe1ad"
  },
  {
   "subject": "UK GDPR Article 28, processors",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/28",
   "document": "legislation.gov.uk revised text",
   "question": "principle",
   "answer": "processor",
   "answer_text": "what a processor holding data for a customer may and may not do with it",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "processes the personal data only on documented instructions from the controller",
   "text_sha256": "2bead00aa5784bcff134385ba4dccb11afb8357f302bfb1923741d63067b5e1d"
  },
  {
   "subject": "UK GDPR Article 28, processors",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/28",
   "document": "legislation.gov.uk revised text",
   "question": "step",
   "answer": "controller-instruction",
   "answer_text": "the customer's documented instruction, as controller",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "processes the personal data only on documented instructions from the controller",
   "text_sha256": "2bead00aa5784bcff134385ba4dccb11afb8357f302bfb1923741d63067b5e1d"
  },
  {
   "subject": "UK GDPR Article 28, processors",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/28",
   "document": "legislation.gov.uk revised text",
   "question": "words",
   "answer": "stated",
   "answer_text": "if a processor infringes this Regulation by determining the purposes and means of…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.",
   "text_sha256": "2bead00aa5784bcff134385ba4dccb11afb8357f302bfb1923741d63067b5e1d"
  },
  {
   "subject": "UK GDPR Article 5(1)(b), purpose limitation",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "document": "legislation.gov.uk revised text",
   "question": "principle",
   "answer": "principles",
   "answer_text": "the principles every use of personal data must meet",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "for specified, explicit and legitimate purposes and not further processed",
   "text_sha256": "25a9d8f8009872e0433d4cd45121ffc8d2d4756f39c0dd3d6e332be90376bd04"
  },
  {
   "subject": "UK GDPR Article 5(1)(b), purpose limitation",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "document": "legislation.gov.uk revised text",
   "question": "step",
   "answer": "compatibility",
   "answer_text": "a new purpose compatible with the original one",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "in a manner that is incompatible with",
   "text_sha256": "25a9d8f8009872e0433d4cd45121ffc8d2d4756f39c0dd3d6e332be90376bd04"
  },
  {
   "subject": "UK GDPR Article 5(1)(b), purpose limitation",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "document": "legislation.gov.uk revised text",
   "question": "words",
   "answer": "stated",
   "answer_text": "for specified, explicit and legitimate purposes and not further processed",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "for specified, explicit and legitimate purposes and not further processed",
   "text_sha256": "25a9d8f8009872e0433d4cd45121ffc8d2d4756f39c0dd3d6e332be90376bd04"
  },
  {
   "subject": "UK GDPR Article 6(1), lawful bases",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "document": "legislation.gov.uk revised text",
   "question": "principle",
   "answer": "lawful-basis",
   "answer_text": "the lawful bases for using personal data",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies:",
   "text_sha256": "7a5a6f24fb31d9243763b59989fd13d94b3c2be38ee902535f7781e7fa9a121d"
  },
  {
   "subject": "UK GDPR Article 6(1), lawful bases",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "document": "legislation.gov.uk revised text",
   "question": "step",
   "answer": "lawful-basis",
   "answer_text": "a lawful basis for the new use",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies:",
   "text_sha256": "7a5a6f24fb31d9243763b59989fd13d94b3c2be38ee902535f7781e7fa9a121d"
  },
  {
   "subject": "UK GDPR Article 6(1), lawful bases",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "document": "legislation.gov.uk revised text",
   "question": "words",
   "answer": "stated",
   "answer_text": "processing is necessary for the purposes of the legitimate interests pursued by the…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data",
   "text_sha256": "7a5a6f24fb31d9243763b59989fd13d94b3c2be38ee902535f7781e7fa9a121d"
  },
  {
   "subject": "UK GDPR Article 8A, further processing",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/8A",
   "document": "legislation.gov.uk revised text",
   "question": "principle",
   "answer": "further-use",
   "answer_text": "when personal data may be used for a purpose other than the one it was collected for",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "of whether processing of personal data by or on behalf of a controller for a purpose (a “new purpose”) other than the purpose for which the controller collected the data (“the original purpose”) is processing in a manner compatible with the original purpose.",
   "text_sha256": "e53e62c075db8fba1ceb428cc18cb90a6409aa5abcc403400c8612bf985b4aae"
  },
  {
   "subject": "UK GDPR Article 8A, further processing",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/8A",
   "document": "legislation.gov.uk revised text",
   "question": "step",
   "answer": "compatibility",
   "answer_text": "a new purpose compatible with the original one",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "In making the determination, a person must take into account, among other things—",
   "text_sha256": "e53e62c075db8fba1ceb428cc18cb90a6409aa5abcc403400c8612bf985b4aae"
  },
  {
   "subject": "UK GDPR Article 8A, further processing",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/8A",
   "document": "legislation.gov.uk revised text",
   "question": "words",
   "answer": "stated",
   "answer_text": "any link between the original purpose and the new purpose;",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "any link between the original purpose and the new purpose;",
   "text_sha256": "e53e62c075db8fba1ceb428cc18cb90a6409aa5abcc403400c8612bf985b4aae"
  }
 ],
 "sources": [
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "label": "UK GDPR Article 5, principles",
   "license": "from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "label": "UK GDPR Article 6, lawfulness",
   "license": "from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/8A",
   "label": "UK GDPR Article 8A, purpose limitation: further processing",
   "license": "from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/28",
   "label": "UK GDPR Article 28, processor",
   "license": "from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-a-processor/",
   "label": "ICO: what does it mean if you are a processor",
   "license": "from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  }
 ],
 "methodology": "Each provision's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance were read through estate-fetch and stored whole (sha256 on every row). For every page, three questions were answered from its own words: what the provision settles, what it asks before the logs move, the rule, in its words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the page read does not address the question. A provision with several pages reads 'varies' where they disagree. 5 provisions, 5 pages.",
 "embed": "<figure style=\"margin:0;padding:16px;border:1px solid #d0d0d0;background:#ffffff\"><blockquote style=\"margin:0 0 8px;background:#ffffff\">5 provisions of UK GDPR and the Information Commissioner's guidance on reusing personal data that agent logs hold, each quoted from legislation.gov.uk or ico.org.uk, read 28 October 2026.</blockquote><figcaption style=\"background:#ffffff\"><a href=\"https://sellagentlogstoai.com/datasets/agent-log-uk-data-law/\" style=\"background:#ffffff\">UK data law on passing on agent logs with personal data, sellagentlogstoai.com</a></figcaption></figure>"
}