All Legislation
Data Protection & Privacy Law
c. 12
UK-wide
Data Protection Act 2018
View on legislation.gov.ukThis page covers UK-wide law. Where local procedure differs (e.g. courts or tribunals), this is noted in the relevant section.
Last amended by Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 in 2020. Created the UK GDPR by adapting the EU GDPR for the UK post-Brexit.
Independent editorial summary — not the official statute text. Read the official version on legislation.gov.uk.
Summary
The Data Protection Act 2018 supplements the UK GDPR and provides the domestic framework for data protection in the UK. It sets out rules for processing personal data, establishes the role of the Information Commissioner, and provides for enforcement and penalties.
Key Points
- Supplements and tailors the UK GDPR for the UK context
- Provides exemptions from certain data subject rights for purposes including national security, crime prevention, and journalism
- Establishes the Information Commissioner's Office (ICO) as the independent supervisory authority
- ICO can impose fines of up to £17.5 million or 4% of annual worldwide turnover
- Provides for data protection impact assessments for high-risk processing
- Special category data (health, race, religion, etc.) requires additional safeguards
- Creates criminal offences for unlawfully obtaining personal data
- Supplements and adapts UK GDPR for domestic purposes (Part 2)
- Lawful bases for processing personal data
- Data subject rights: access, rectification, erasure, portability
- Special category data and criminal offence data (Schedule 1)
- Journalism, academic, artistic, and literary exemptions (Schedule 2)
- Law enforcement processing (Part 3)
- Information Commissioner's powers and enforcement (Part 5-6)
Parts & Sections
Amendments History
2020 — Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019
Created the UK GDPR by adapting the EU GDPR for the UK post-Brexit.