🇬🇧United Kingdom

The UK privacy framework combines the UK GDPR with the Data Protection Act 2018

The United Kingdom's data protection regime is built around the UK GDPR and the Data Protection Act 2018, now materially amended by the Data (Use and Access) Act 2025. The DPA 2018 supplements the general regime, creates separate regimes for law enforcement and intelligence services processing, establishes the Information Commissioner, and provides enforcement powers, offences, remedies and exemptions.

The 2025 Act is being commenced in stages. Amendments already brought into force include revised rules for data-subject request time limits and clarification, automated significant decisions, recognised legitimate interests and purpose compatibility, international transfers, complaints to controllers and parts of the regulatory and PECR enforcement framework. Compliance decisions must therefore use the amended text and the applicable commencement date, not only the DPA 2018 as originally enacted.

A further UK GDPR Article 17 erasure ground for personal data processed from a qualifying malicious stalking or harassment allegation took effect on 31 March 2026. Rights procedures should identify and route those requests separately.

The Act is not a simple standalone privacy code. It is the domestic statute that completes and adapts the broader UK data protection framework. For most ordinary business, charity, education, healthcare, employment and public-sector processing, the practical analysis starts with the UK GDPR and then checks the DPA 2018 for UK-specific rules, conditions, exemptions, safeguards, enforcement and sector-specific adjustments.

The three ideas to understand first

The DPA 2018 is divided by processing context. Part 2 deals with general processing and supplements the GDPR framework. Part 3 deals with law enforcement processing by competent authorities. Part 4 deals with intelligence services processing. Part 5 establishes the Information Commissioner. Part 6 contains enforcement powers, penalties, offences and remedies.

Special category and criminal offence data need UK-specific conditions. The Act provides additional conditions and safeguards for processing special category data and criminal convictions or offences data. Schedule 1 is central because it sets out conditions for employment, health, research, substantial public interest and criminal conviction processing.

The Information Commissioner is the key regulator. The Act gives the Information Commissioner functions for monitoring and enforcing data protection legislation, issuing codes of practice, handling complaints, conducting audits, issuing information, assessment, enforcement and penalty notices, and pursuing enforcement action.

How the UK framework works in practice

For general processing, the DPA 2018 supplements the UK GDPR. It defines or modifies domestic concepts such as public authority and public body, sets the UK age of child consent for information society services at 13, provides rules for processing special category and criminal conviction data, sets safeguards for automated decisions authorised by law, and creates exemptions for areas such as national security, defence, journalism, research, health, social work, education and child abuse data.

For law enforcement processing, Part 3 creates a separate regime for competent authorities processing personal data for law enforcement purposes. It sets out its own principles, rights, controller and processor obligations, security duties, breach notification, DPO requirements and transfer rules.

For intelligence services processing, Part 4 creates another separate regime. It contains dedicated principles, data subject rights, controller and processor duties, breach communication and transfer rules, with national security and other exemptions.

What organisations should prioritise

Start by classifying the processing. Is it general processing, law enforcement processing, intelligence services processing, or another narrow category? That determines which part of the Act applies and which rights, obligations and exemptions are relevant.

Then identify lawful basis, special-category conditions and criminal-offence conditions. A UK organisation handling health, employment, safeguarding, criminal allegation, equality, fraud prevention, research or public interest data usually needs more than a generic lawful basis. It must also check the DPA 2018 conditions and safeguards, including whether an appropriate policy document is required.

Finally, test the compliance and enforcement layer. Organisations should know how to respond to data subject requests, complaints, ICO investigations, information notices, assessment notices, enforcement notices and penalty notices. They should also understand the offences for unlawfully obtaining personal data, re-identifying de-identified data, and altering data to prevent disclosure to a data subject.