Governance of Data under the REC (Alternative)
Summary
_
Latest update and next planned activity
Date of latest update
Latest Update
_
Impacts Overview
Impacted REC Parties and Market Participants
DCC
Impacted REC Documents
REC Main Body
Priority and rationale
High
Priority last updated on 29 May 2026
Solution development
Problem Statement
The current data protection and governance provisions in the REC are not fit for purpose, having the potential for ambiguity. Changes have been identified, following a legal review, which will provide more clarity for REC Parties who are Data Controllers and/or Data Processors, and to enable RECCo to maintain a comprehensive approach to the governance of data under the REC.
Proposed solution summary
- As a Consumer, I want to have the confidence that my data is being handled compliantly in accordance with the UK GDPR.
- As a REC Party, I want to achieve compliance and have clarification on my obligations in the context of REC Services.
- As a REC Party/Service User, I want to understand the reporting obligations I need to meet if the event of a Personal Data Breach relating to REC Data, to ensure that RECCo Board is made aware. As a REC Party/Service User, I need to understand that I will still need to independently assess and document my respective data protection roles under the REC. As a REC Party/Service User, I need to understand the roles and responsibilities of a Data Controller and/or Data Processor to be able to carry out my obligations under the REC.
No documents available.
Change Plan
REC Party Impact Assessment Issued
Completed
Start:
26 May 2022Due:
10 Jun 2022Completion:
10 Jun 2022Present Revised Change Proposal Plan to the REC Change Panel
Completed
Start:
10 Jun 2022Due:
21 Jun 2022Completion:
21 Jun 2022Deadline for Alternative Change Proposal Plan
Completed
Start:
21 Jun 2022Due:
08 Jul 2022Completion:
08 Jul 2022Preliminary Change Report Issued
Completed
Start:
08 Jul 2022Due:
08 Jul 2022Completion:
08 Jul 2022Consultation Period Start
Completed
Start:
08 Jul 2022Due:
08 Jul 2022Completion:
08 Jul 2022Consultation Period End
Completed
Start:
08 Jul 2022Due:
15 Jul 2022Completion:
15 Jul 2022Final Change Report Issued
Completed
Start:
15 Jul 2022Due:
21 Jul 2022Completion:
21 Jul 2022Responsible Committee Decision
Completed
Start:
21 Jul 2022Due:
26 Jul 2022Completion:
26 Jul 2022Authority Determination
Completed
Start:
26 Jul 2022Due:
02 Aug 2022Completion:
01 Aug 2022Original submission
Change details
Brian O'Shea - RECCo
26 May 2022
Change details
Governance of Data under the REC (Alternative)
This Change Proposal is an Alternative to CP R0046. This modification proposes changes to the REC Main Body in order to clarify and update requirements of the REC which govern the use of data. The existing data protection clauses set out under Clauses 19 and 20 of the REC are being updated to ensure closer alignment with UK GDPR requirements following developments in the legal and regulatory landscape since the GDPR came into force in 2018 (including updated guidance issued by the ICO and the impact of Brexit).
The updated data protection clauses address, in particular, the following provisions: Removing the potential for ambiguity by making the clauses more agnostic in relation to which entity is a Data Controller and/or Data Processor– thereby requiring the REC Parties to assess their own circumstances when the relevant clauses will apply; Imposing additional internal reporting obligations on parties who have suffered a personal data breach to ensure that REC Board is made aware; and Tightening definitions. REC Parties will still need to independently assess and document their respective data protection roles under the REC.
The Parties to the REC wish to achieve better compliance and clarity regarding their data protection obligations in the context of the REC services. The changes to the REC clauses are a critical step in this process.
The content of this change proposal has been the subject of series of meetings between DCC and RECCo and their respective legal advisors and discussions have been overseen by Ofgem. The drafting proposed for Clauses 19 and 20 has been agreed between DCC and RECCo. It is essential that the REC provisions are updated to reflect the proposed changes to ensure that DCC is able to comply with its obligation to submit RMP (MPXN) reporting information in accordance with Paragraph 8.1 of the REC Central Switching Service Definition from CSS Go-Live Date Change Proposal R0046 also includes proposed changes to Clause 18 of the REC Main Body, those changes have been removed from the scope of this proposal.
Impacts
Other (please specify in the Additional information box below)
Other (please provide details in Additional information box below)
No direct Consumer impact
REC Main Body
-
No details provided
-
No details provided
-
No details provided
-
No details provided
-
No details provided
-
DCC
-
No details provided
-
No
No details provided
Priority & timing
Yes
Yes. The changes to are required to ensure DCC can meet its REC Obligations to submit RMP/MPXN reporting data from the REC v3.0 Go-Live Date
The changes to are required to ensure DCC can meet its REC Obligations to submit RMP/MPXN reporting data from the REC v3.0 Go-Live Date
R0046 and this alternative CP must have aligned Change Proposal plan milestones
No details provided
-
Activity
Proposed solution summary changed to As a Consumer, I want to have the confidence that my data is being handled compliantly in accordance with the UK GDPR.As a REC Party, I want to achieve compliance and have clarification on my obligations in the c…
Proposed solution summary changed to As a Consumer, I want to have the confidence that my data is being handled compliantly in accordance with the UK GDPR.As a REC Party, I want to achieve compliance and have clarification on my obligations in the context of REC Services.As a REC Party/Service User, I want to understand the reporting obligations I need to meet if the event of a Personal Data Breach relating to REC Data, to ensure that RECCo Board is made aware. As a REC Party/Service User, I need to understand that I will still need to independently assess and document my respective data protection roles under the REC. As a REC Party/Service User, I need to understand the roles and responsibilities of a Data Controller and/or Data Processor to be able to carry out my obligations under the REC..
Show moreImplementation Date has been updated to 03 Aug 2022.
rosalind.timperley has been allocated as SME.