This page covers UK-wide law. Where local procedure differs (e.g. courts or tribunals), this is noted in the relevant section.
Last amended by Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 in 2020. Created the UK GDPR by adapting the EU GDPR for the UK post-Brexit.
Independent editorial summary — not the official statute text. Read the official version on legislation.gov.uk.
Summary
The Data Protection Act 2018 supplements the UK GDPR and provides the domestic framework for data protection in the UK. It sets out rules for processing personal data, establishes the role of the Information Commissioner, and provides for enforcement and penalties.
Key Points
- Supplements and tailors the UK GDPR for the UK context
- Provides exemptions from certain data subject rights for purposes including national security, crime prevention, and journalism
- Establishes the Information Commissioner's Office (ICO) as the independent supervisory authority
- ICO can impose fines of up to £17.5 million or 4% of annual worldwide turnover
- Provides for data protection impact assessments for high-risk processing
- Special category data (health, race, religion, etc.) requires additional safeguards
- Creates criminal offences for unlawfully obtaining personal data
- Supplements and adapts UK GDPR for domestic purposes (Part 2)
- Lawful bases for processing personal data
- Data subject rights: access, rectification, erasure, portability
- Special category data and criminal offence data (Schedule 1)
- Journalism, academic, artistic, and literary exemptions (Schedule 2)
- Law enforcement processing (Part 3)
- Information Commissioner's powers and enforcement (Part 5-6)
Parts & Sections
Amendments History
2020 — Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019
Created the UK GDPR by adapting the EU GDPR for the UK post-Brexit.
Frequently asked questions
- What is the main purpose of the Data Protection Act 2018?
- The Data Protection Act 2018 supplements the UK GDPR to create a domestic framework for data protection in the UK. It sets out rules for processing personal data, establishes the role of the Information Commissioner, and provides for enforcement and penalties. The Act adapts the UK GDPR for domestic purposes and includes specific provisions for areas like law enforcement and journalism.
- What role does the Information Commissioner's Office play under this Act?
- The Information Commissioner's Office (ICO) is established as the independent supervisory authority under the Act. The Information Commissioner is a corporation sole responsible for promoting good practice in data handling. The ICO has powers to serve enforcement notices requiring controllers or processors to take specific steps to comply with data protection legislation.
- What are the maximum fines for breaching data protection laws?
- The Act allows the Information Commissioner to impose monetary penalties for serious failures to comply with data protection legislation. The maximum penalty that can be imposed is £17.5 million or 4% of annual worldwide turnover. These penalties are part of the enforcement powers granted to the ICO to ensure compliance with the law.
- Are there any exemptions to data subject rights under the Act?
- The Act provides exemptions from certain data subject rights for specific purposes, including national security, crime prevention, and journalism. It also includes exemptions for academic, artistic, and literary activities. These provisions are detailed in Schedule 2 of the Act and allow for different handling of personal data in these contexts.
- How does the Act treat sensitive personal data like health or race?
- Special category data, which includes information about health, race, and religion, requires additional safeguards under the Act. The legislation also creates criminal offences for unlawfully obtaining personal data. These measures are designed to provide stronger protection for sensitive personal information compared to standard personal data.