When it comes to the GDPR fairness is not the same as nice. The first data protection principle of the UK GDPR requires that personal data is processed lawfully, fairly, and transparently. These three elements are closely connected, but each carries its own weight.
Of the three, fairness is often the least well understood. This may be because it is the least objective. Organisations sometimes assume that “fair” means being kind, generous, or avoiding difficult decisions. That is not the case.
Fairness is not the same as being nice. It is about being justifiable, proportionate, and aligned with reasonable expectations.
Understanding this distinction is critical—especially in areas like HR, compliance, investigations, and safeguarding, where decisions can have serious consequences.
What Does “Fairness” Mean Under GDPR?
Fairness requires organisations to process personal data in a way that:
- individuals would reasonably expect,
- does not mislead or deceive,
- avoids unjustified harm or detriment,
- and respects individuals’ rights and interests.
It is about how power is exercised when handling personal data.
Fairness asks a simple but important question:
Would a reasonable person consider this use of their data appropriate in the circumstances?
Fairness Is Not About Being “Nice”
A common misconception is that fairness means avoiding outcomes that are negative for the individual. In reality, organisations often need to process data in ways that are uncomfortable or unwelcome.
Fairness does not prevent this. It requires that such processing is:
- necessary,
- proportionate, and
- properly justified.
An organisation can act fairly even when the outcome is unfavourable to the individual.
Example: HR Disciplinary Investigations
Consider an employer investigating misconduct.
This may involve:
- reviewing emails,
- analysing access logs,
- examining CCTV footage,
- interviewing colleagues.
From the employee’s perspective, this may feel intrusive or even adversarial. It is certainly not “nice.”
However, it can still be fair if:
- the employer has a legitimate reason (e.g. investigating wrongdoing),
- the scope of the investigation is proportionate,
- the employee has been informed through policies or privacy notices that such monitoring may occur,
- access to data is limited to those who need it,
- the process is conducted consistently and without bias.
In this context, fairness is about process and justification, not outcome.
Example: Monitoring in the Workplace
Many organisations monitor employee activity to:
- protect systems,
- detect fraud,
- ensure compliance,
- maintain productivity.
Monitoring can feel intrusive. But it can be fair if:
- employees are clearly informed about it,
- it is targeted and proportionate,
- the monitoring is not excessive or covert without strong justification,
- it serves a legitimate organisational purpose.
Unfairness arises where monitoring is:
- hidden without justification,
- overly broad (“just in case”),
- used in ways employees could not reasonably expect.
Example: Using Data for Performance Management
Employers regularly use personal data to:
- assess performance,
- make promotion decisions,
- initiate capability processes.
These decisions may have significant consequences for employees.
Again, fairness does not require these decisions to be favourable. It requires that they are:
- based on accurate and relevant data,
- applied consistently,
- not discriminatory,
- aligned with communicated processes.
Using data to make difficult decisions can still be entirely fair.
When Does Processing Become Unfair?
Processing is likely to be unfair when:
- individuals are misled or unaware of how their data will be used,
- data is used in a way that is unexpected or excessive,
- decisions are made using inaccurate or incomplete data,
- there is a power imbalance that is exploited,
- data is used in a way that causes unjustified harm or distress.
Fairness is closely linked to trust. When people feel blindsided or treated inconsistently, fairness has usually been compromised.
Fairness and Transparency Go Hand in Hand
Fairness cannot exist without transparency.
If individuals do not understand:
- what data is being collected,
- why it is being used,
- how decisions are made,
then it becomes very difficult to argue that the processing is fair.
This is why privacy notices, policies, and clear communication are so important. They set expectations and provide context.
Fairness Requires Proportionality
Fairness is also about balance.
Organisations must weigh:
- their legitimate interests or obligations,
against - the impact on individuals.
This is particularly important when:
- using monitoring tools,
- conducting investigations,
- processing sensitive data,
- making decisions with significant effects.
If the same objective can be achieved in a less intrusive way, fairness may require that alternative to be used.
Practical Steps to Ensure Fairness
To embed fairness into data processing, organisations should:
- Clearly explain data use through accessible privacy information
- Avoid surprises—align practice with what people are told
- Use only what is necessary—do not collect or process data “just in case”
- Apply consistent standards across individuals and teams
- Check data accuracy before making decisions
- Train staff to understand appropriate use of personal data
- Document decisions, especially where processing is intrusive or sensitive
Fairness is not achieved by intention alone. It requires structured decision-making.
Final Thought
The fairness principle is not about being agreeable or avoiding difficult outcomes. Organisations will, at times, need to use personal data in ways that are uncomfortable or contested.
The key question is not whether the processing is pleasant.
It is whether it is justified, proportionate, transparent, and consistent with reasonable expectations.
That is what fairness looks like under the UK GDPR.