Reading the information on the ICO's website, I came across a few items mentioning how to handle metadata on my organization's workflow like THIS or THIS.

I noticed they use expressions like "should consider" or "is recommendable" when they refer to handling a document's metadata.

As I understand, they do not enforce any "special treatment" to these pieces of information.

Other European countries, like Spain, have special laws that describe how public bodies or private companies must handle metadata.

  1. Is there an equivalent law applicable in the UK?
  2. Who is responsible for the information contained in such metadata?


This is a follow up question after reading @Amon comment.

Let's say for a given organization the person responsible for Data Protection Act compliance do all due dilligences up to his/her knowledge to make sure that the company is compliant.

At one point, a third party discover a vulnerability that produces a data breach and notify the organization's DPO with the details of the data breach, but the DPO "do not believe" the info and just ignore the new information.

  1. Is that "bad practice"?
  2. Is this something regulated?
  3. Is there any responsible for "ignore that"?
  4. Who else should be notified?
  • Your edit is essentially an entire question of its own, so I will not amend my answer to cover those aspects as well. Consider asking a separate question about responsibilities with respect to data breaches.
    – amon
    Commented Aug 28, 2022 at 19:37
  • Hi @amon, that is a fair point. I have added it on here in case you find the topic interesting: law.stackexchange.com/questions/83704/… Commented Aug 28, 2022 at 20:01

1 Answer 1


Specific laws or regulations relating to metadata are unnecessary, and possibly counter-productive.

UK data protection law is centered around the GDPR, which is largely principle-based – instead of providing a checklist of very concrete compliance measures, it is the data controller's responsibility to determine appropriate measures in order to achieve the data protection principles. For example, this obligation is expressed in Art 24 GDPR:

Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. […]

What risks exist for what activities is extremely contextual. Leaking information through metadata is a potential risk, but it's not a risk in every context. Thus, data controllers should consider whether metadata could pose a privacy problem in their workflows, but they are not necessarily required to redact such metadata.

This provision of the UK GDPR is already enforceable, but it would need a case by case analysis to determine whether the risk analysis and selection of technical and organizational measures have been conducted incorrectly.

The documents you linked are a HMRC internal manual. These are not normative – they do not bind other organizations. Instead, the existence of these manuals is an expression of HRMC's own obligation to consider various risks and implement appropriate technical and organizational measures (TOMs). Of course, other organizations could use such manuals as a starting point for their own analysis.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .