Skip to main content

Data protection and COVID-19 | Don’t let misunderstandings risk lives

Data protection law, although still applicable, should not be misunderstood.

In these unprecedented and challenging times, it is more important than ever that ignorance or a misunderstanding of the law does not put people at risk. Data protection law, although still applicable, should not be misunderstood.

The Information Commissioners Office (“ICO”) has provided pragmatic and welcome guidance on this topic. It is clear the ICO understands that organisations may need to share personal data quickly and adapt the way they work. Proportionality is the key.

Data protection during the pandemic

The ICO has made it clear it understands that organisations may be ‘diverted’ away from usual compliance.  This is not a defence and statutory timescales, for example, cannot be formally extended. However, the ICO’s current view is that it would be reluctant to penalise organisations in certain limited circumstances, while it has informed data subjects that there may be delays.

Data protection law still applies and compliance is mandatory. However the ICO will approach such matters with common sense.

Remote working and data protection

For a detailed analysis see our latest legal update Data protection and Coronavirus. It is clear that remote working is likely to be a requirement for some time and data protection should not prevent it. However, organisations should ensure that its usual security measures are adhered to.

Sharing COVID-19 information with staff

The ICO has made it clear that staff should be informed about COVID-19 cases in your organisation. That said, individuals need not be named and only necessary information should be provided. Data protection law has never prevented organisations from ensuring the health and safety of its staff and COVID-19 has not changed this.

In summary, data protection law still applies. However it is not (and was never intended to be) a barrier to organisations carrying on its business or protecting its staff.  It is worth repeating - proportionality is the key.  If it feels excessive, it is likely that it is.

We are here to support you during this difficult period with your data protection and other legal needs. If you would like to discuss any detail in this update or to discuss anything further please contact Sean Crotty by email at 


View our latest guidance on how to plan, prepare and protect your organisation.

Read our guidance

Sectors and Services featured in this article

Share on Twitter