5 November 2026

Beyond Compliance: Putting Ethics at the Heart of Data Protection

Why organisations should look beyond what they can do with personal data and ask what they should do.

By Clare Chatfield, Information Governance Manager

Data protection is often framed as a compliance exercise: is processing lawful, is the paperwork complete and have risks been managed?  These questions matter, but they are only part of the picture.  At its heart, data protection law safeguards people’s rights, freedoms and dignity.

The UK GDPR makes this human focus explicit through its protection of individuals and their fundamental rights and freedoms.  Rooted in human rights, data protection addresses how information can be used to diminish autonomy, reinforce inequality or enable harmful surveillance.  Effective compliance therefore demands more than a technical rulebook.

From “can we?” to “should we?”
A mature data protection culture asks three connected questions: can we do this in practice, may we do it within the law, and should we do it given the effects on people?  Ethical judgement makes the third question explicit, while people’s rights and interests must inform the legal assessment too.

Terms such as “reasonable”, “appropriate” and “proportionate” require judgement.  The responsibility for considerations should not fall to the Data Protection Officer alone.  Leaders and operational teams need to explain who decided, what evidence informed them, whose interests were considered and how safeguards will be reviewed.

Fairness is more than lawfulness and transparency
Fairness is a legal requirement, not simply an ethical aspiration.  A lawful basis and clear explanation do not, alone, establish UK GDPR compliance.  Organisations must also assess whether processing is fair, including whether it creates unjustified discriminatory, disproportionate or chilling effects.  A privacy notice does not make an outcome fair.

Consider fairness as both a process and an outcome.  Were affected people meaningfully considered?  Is there a power imbalance?  Could a standardised approach disadvantage particular groups?  Are benefits proportionate to the intrusion or potential harm?   For example, a retailer may have a legitimate interests basis for analysing purchase histories to tailor offers.  However, using that analysis to identify customers in financial difficulty and target them with pressure-based promotions could be unfair: it exploits vulnerability and may cause harm, even if explained in a privacy notice.  A lawful basis alone does not make processing compliant.

Unintended consequences are not always unforeseeable.  Teams should challenge assumptions and examine likely human impacts before launching a system, campaign or service.

Use DPIAs as decision-making tools
Data protection impact assessments (DPIAs) are most valuable as living decision-making tools, rather than merely paperwork for the regulator.  A good DPIA explains necessity and proportionality, identifies effects on people and establishes how safeguards will be revisited as technology, context and evidence change.

Warning signs include involving the Data Protection Officer late, assuming controls work, adopting one-size-fits-all solutions and never reviewing assessments.  Positive indicators include inclusive design, privacy built in from the start and safeguards tested for real-world effectiveness.

Move from cosmetic to protective compliance

Three illustrative approaches, not regulatory categories or a formal assessment model, offer a useful lens.  Cosmetic compliance prioritises paperwork.  Defensive compliance focuses on major business risks.  Protective compliance safeguards people’s rights and freedoms while seeking value from data with the least possible human harm.

To move towards a protective approach organisations should:

• connect decisions to rights and freedoms;
• assess human impacts alongside business risks;
• record and challenge judgements about proportionality;
• test safeguards in practice; and
• revisit legitimate interests assessments, DPIAs and technical measures when circumstances change.

Ethical data protection is not an optional extra.  It makes decisions more accountable and keeps data protection work focused on people.

A credible, inclusive and documented process must produce lawful, protective decisions not merely justify existing plans.  Organisations should change or stop activities when consequences cannot be justified, and review decisions as those consequences become clearer.  There will be occasions where a particular use of personal data is lawful but still feels intrusive, unexpected or difficult to justify.  Ethical decision-making requires consideration of what individuals would reasonably expect and whether a different approach could achieve the same objective with less impact on people’s rights and freedoms.

Remember – data protection isn’t about protecting data, it’s about protecting people.

Would you like support embedding ethical thinking into your governance, DPIAs or decision-making frameworks? Our consultancy can help translate legal requirements into practical, people-centred processes. Click on the link above or email us at info@naomikorn.com for more information.