STEP is aware that many members are looking for clarification as to how GDPR should be interpreted in the context of trusts and estates.

STEP’s Data Protection Working Group has made submissions to, and had discussions with, the Information Commissioner’s Office on this topic, and intends to publish guidance early next year (most likely in January or February 2020).

The topics covered by the guidance will include:

• how to apply tests such as ‘number of staff’ and ‘turnover’ in the trusts and estates context;
• the distinction between data processors and data controllers;
• the extent to which GDPR applies to trustees and personal representatives acting in a non-professional capacity;
• the legal basis on which trustees and personal representatives can process special category data;
• the circumstances in which trustees and personal representatives should issue privacy notices to beneficiaries; and
• the obligations on trustees and personal representatives when responding to subject access requests.

The Data Protection Working Group intends to add to this guidance in due course, including setting out views on matters such as the treatment of bare trusts and of attorneys and deputies.

Edward Hayes, Chair of STEP Data Protection Working Group