Home › Blog › Data ethics and privacy
Data Privacy vs Data Ethics: What the Law Requires, What It Leaves to You, and How to Tell the Difference
The question of data privacy vs data ethics comes down to one line: privacy is about what the law requires you to do with personal data, ethics is about whether you should be doing it at all. In the UK, data privacy means UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Data ethics covers the decisions those laws leave open. A business can be fully compliant and still lose customers' trust; this page explains where the two part company.
Data privacy: the legal floor
Data privacy, or data protection as UK law calls it, is a set of enforceable rules about personal data: information that identifies a living person. Under UK GDPR, an organisation must have a lawful basis for each use, tell people what it is doing, collect no more than it needs, keep data accurate and secure, hold it no longer than necessary, and respect rights such as access and erasure. Our UK GDPR explainer covers the principles in full.
The Data (Use and Access) Act 2025 amended those rules. Most of its data protection changes came into force on 5 February 2026, including a list of recognised legitimate interests and new rules on automated decision-making, and a duty on organisations to have a process for handling data protection complaints followed from 19 June 2026. None of this turned data protection into an ethics code: it is still a compliance regime, enforced by the Information Commissioner's Office, with fines under UK GDPR of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
Data ethics: the questions the law leaves open
Data ethics asks whether a use of data is fair, respectful and acceptable to the people it affects. It goes further than the law in three ways:
- It covers more data. Anonymised and aggregate data falls outside UK GDPR, but a pricing model built on postcode data can still treat whole communities unfairly.
- It asks about outcomes, not process. A lawful basis and a privacy notice settle whether you may process data; they do not settle whether the result is something customers would accept.
- It can say no. Compliance work tends to ask how to make a project lawful. An ethics review can conclude the project should not go ahead.
Our page on data ethics for business sets out the principles; this page is about where the line falls between the two.
Where privacy and ethics overlap
The overlap is bigger than many businesses assume. UK GDPR's first principle requires processing to be lawful, fair and transparent, and the ICO's guidance treats fairness as a real test: using data in ways people would not reasonably expect, or in ways that have unjustified adverse effects on them, can breach the law even where a lawful basis exists. A data protection impact assessment, required for high-risk processing, also forces a business to weigh risks to people's rights. Our guide to running a DPIA shows how to fold ethical questions into that document rather than running a separate process.
Cases that show the gap
Royal Free and DeepMind (2017)
The Royal Free London NHS Foundation Trust gave Google DeepMind about 1.6 million patient records to test an app that detected acute kidney injury. The aim was clinically worthwhile. In July 2017 the ICO ruled the trust had failed to comply with data protection law, because patients were not adequately told their records would be used this way. A good purpose did not make the processing fair.
Facebook and Cambridge Analytica (2018)
Data on up to 87 million Facebook users worldwide was harvested through a personality quiz app and used for political profiling. The ICO fined Facebook £500,000 in October 2018, the maximum available under the old Data Protection Act 1998. The lasting cost was not the fine: it was the public loss of trust in how platforms use data, which no compliance file could have repaired.
Workplace monitoring
Keystroke logging, webcam checks and productivity scoring can each be given a lawful basis on paper. Whether they are proportionate, and what they do to trust inside a team, is an ethical judgement first. Our page on workplace surveillance ethics covers it in detail.
A simple test to apply to any data project
| Question | Privacy or ethics? |
|---|---|
| Do we have a lawful basis and a privacy notice that covers this? | Privacy |
| Are we collecting only what we need, and deleting it on time? | Privacy |
| Would the people in this data be surprised or upset to learn about this use? | Both: unexpected use can be unfair in law |
| Could the result disadvantage a group, even with anonymised data? | Ethics |
| Would we be comfortable explaining this on the front page of a newspaper? | Ethics |
| Is there a less intrusive way to get the same benefit? | Both |
If the honest answer to any ethics question is uncomfortable, that is the signal to change the design, not just the wording of the privacy notice. For AI projects specifically, see our responsible AI principles and algorithmic bias explainer.
Who owns which in a business
Compliance usually sits with a data protection officer or privacy lead, who keeps records of processing, handles rights requests and reports breaches. Data ethics has no statutory owner. Businesses that take it seriously give it a named board sponsor and a review step for new data uses, often combined with AI governance; our guide to building an AI governance framework shows one structure. The point is that someone with authority has to be able to stop a project that is legal but wrong. For the wider foundations, start at the E-Business Ethics homepage.
Sources: ICO, the data protection principles; Data (Use and Access) Act 2025; Digital Health, report of the ICO Royal Free and DeepMind ruling (July 2017); Computer Weekly, report of the ICO Facebook fine (October 2018). Checked 25 October 2026.
Frequently Asked Questions
What is the difference between data privacy and data ethics?
Data privacy is compliance with the law on personal data: in the UK, UK GDPR and the Data Protection Act 2018. Data ethics asks whether a use of data is fair and acceptable to the people affected, including uses the law permits.
Is data ethics a legal requirement in the UK?
Not as a separate duty. But UK GDPR's fairness and transparency principles pull some ethical judgement into law: processing people would not reasonably expect, or that harms them unjustifiably, can be unlawful even with a lawful basis.
Can something be legal but unethical with data?
Yes. Inferring sensitive traits from shopping data, or re-using data in ways customers would object to, may be defensible on paper and still damage trust. Many failures start as legal decisions nobody tested against expectations.
Who is responsible for data ethics in a business?
There is no statutory data ethics officer. The data protection officer covers compliance; ethics usually sits with a board-level owner, an ethics or AI review group, or the people approving new data projects.
Does data ethics apply to anonymised data?
Yes. Truly anonymised data falls outside UK GDPR, but decisions made with it can still treat groups unfairly. Aggregate data used to price, target or exclude whole postcodes raises ethical questions the law does not answer.