🇬🇧Data Protection Act 2018

← Back to laws in United Kingdom

A domestic data protection statute that sits beside the UK GDPR

The Data Protection Act 2018 regulates the processing of information relating to individuals and forms a central part of the UK's data protection framework. It is structured to work with the UK GDPR for general processing, while also creating separate domestic regimes for law enforcement and intelligence services processing. It must now be read with the Data (Use and Access) Act 2025 and the commencement regulations that have progressively brought its amendments into force.

The Act protects individuals with regard to processing of personal data by requiring lawful and fair processing, conferring data subject rights, and assigning monitoring and enforcement responsibility to the Information Commissioner. For most organisations, the DPA 2018 is the statute that answers UK-specific questions that the GDPR framework leaves to domestic law.

Structure — why the Act must be read by processing type

Part 1 contains preliminary provisions, including the overview and core terms. Section 1 explains the Act's structure: Part 2 supplements the GDPR framework and applies a broadly equivalent regime to certain other processing; Part 3 covers law enforcement processing; Part 4 covers intelligence services processing; Part 5 deals with the Information Commissioner; Part 6 deals with enforcement; and Part 7 contains supplementary provisions.

Section 3 defines personal data as information relating to an identified or identifiable living individual. Processing includes operations such as collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure and destruction.

The Act uses different meanings of controller and processor depending on the relevant Part. That is why classification matters. General commercial processing, police processing, and intelligence processing are not governed by exactly the same operative provisions.

General processing — Part 2 and the GDPR framework

Part 2 is relevant to most processing of personal data. Chapter 2 supplements the GDPR framework for processing to which the GDPR applies. Chapter 3 applies a broadly equivalent regime to certain processing outside that GDPR scope, including some public-authority and foreign or security policy contexts, subject to modifications.

Section 6 clarifies the meaning of controller where personal data is processed because an enactment requires it. In those cases, the person on whom the obligation to process the data is imposed by the enactment is the controller. Section 7 defines public authority and public body for UK purposes.

Section 8 clarifies public-interest lawful processing. The GDPR public task basis includes processing necessary for the administration of justice, functions of Parliament, functions conferred by enactment or rule of law, Crown, ministerial or government department functions, and activities supporting or promoting democratic engagement.

Section 9 sets the age for a child's consent in relation to information society services at 13, and excludes preventive or counselling services from the information society services reference.

Special category and criminal convictions data

Section 10 is one of the most important practical provisions. It provides that certain GDPR exceptions for processing special category data meet the UK-law requirement only if the processing meets a condition in Schedule 1. This includes employment, social security and social protection; substantial public interest; health and social care; public health; and archiving, research and statistics.

Section 10 also covers criminal convictions and offences data where processing is not carried out under the control of official authority. Such processing meets the GDPR Article 10 requirement only if it satisfies a condition in Part 1, 2 or 3 of Schedule 1.

Section 11 supplements health and social care processing by recognising circumstances where processing is carried out by or under the responsibility of a health professional or social work professional, or by another person owing a duty of confidentiality under enactment or rule of law.

Data subject rights, automated decision-making and exemptions

Section 12 allows limits on fees controllers may charge for manifestly unfounded or excessive requests or further copies. Section 13 deals with credit reference agencies and frames the access obligation around personal data relating to the data subject's financial standing unless the data subject indicates otherwise.

The Data (Use and Access) Act 2025 replaced the former general automated-decision architecture with new UK GDPR Articles 22A-22D. Controllers must identify whether a decision is based solely on automated processing and has a significant effect, apply the special restrictions for significant decisions based on special-category data, and provide safeguards including information, representations and human intervention. Section 14 continues to be relevant within the DPA's separate regimes, so the processing context must be classified before applying a rule.

Section 15 and Schedules 2, 3 and 4 are central to exemptions and restrictions. These include restrictions and adaptations for specified public interest circumstances, protection of rights of others, freedom of expression and information, research, statistics and archiving, and sectoral data such as health, social work, education and child abuse data.

2025 amendments and staged commencement

The Data (Use and Access) Act 2025 introduced recognised legitimate interests, clearer compatibility and research provisions, revised request timing and clarification rules, a new automated-decision framework, a risk-based international-transfer test, controller complaint-handling duties and changes to the Information Commissioner's organisation and enforcement powers. These changes do not all share one commencement date.

Organisations should maintain a commencement matrix. In particular, the sixth commencement regulations brought specified provisions into force on 5 February 2026 and the statutory controller-complaints process on 19 June 2026, with transitional rules for requests, automated decisions, penalties and pre-commencement complaints. Later or sector-specific commencement instruments must also be checked before relying on a provision.

Archiving, research and statistics

Section 19 provides safeguards for processing necessary for archiving in the public interest, scientific or historical research, or statistical purposes. Such processing does not satisfy the Article 89 safeguard requirement if it is likely to cause substantial damage or substantial distress to a data subject.

It also does not satisfy the safeguard requirement if it is carried out for measures or decisions with respect to a particular data subject, unless the purposes include approved medical research. The Act then defines approved medical research by reference to recognised ethics approval mechanisms and relevant NHS and research bodies.

Law enforcement processing — Part 3

Part 3 applies to processing by competent authorities for law enforcement purposes. Section 31 defines law enforcement purposes as prevention, investigation, detection or prosecution of criminal offences or execution of criminal penalties, including safeguarding against and prevention of threats to public security.

Part 3 contains its own data protection principles. These include lawful and fair processing, specified, explicit and legitimate law enforcement purposes, adequate and relevant data that is not excessive, accuracy and updating, storage limitation and secure processing. The controller is responsible for and must be able to demonstrate compliance.

Sensitive law enforcement processing is subject to additional restrictions. It generally requires consent plus an appropriate policy document, or strict necessity, a Schedule 8 condition, and an appropriate policy document. Sensitive processing includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, sex life and sexual orientation.

Part 3 also creates law enforcement data subject rights, including access, rectification, erasure, restriction and safeguards around automated individual decision-making. It sets controller and processor duties, records of processing, logging, cooperation with the Commissioner, DPIAs, prior consultation, security, breach notification to the Commissioner and communication to the data subject.

Intelligence services processing — Part 4

Part 4 creates a separate regime for processing by the intelligence services. It includes principles, rights, controller and processor obligations, breach communication, transfers outside the United Kingdom and exemptions.

Because intelligence processing engages national security, Part 4 includes specific national security and other exemptions. It should not be mixed with the general processing regime or the law enforcement regime. Organisations working with intelligence-service contexts must analyse Part 4 separately.

The Information Commissioner — Part 5

Part 5 provides for the Information Commissioner. The Commissioner has general functions under the GDPR framework and the Act, including monitoring and enforcement, advising, promoting awareness, handling complaints, and international cooperation.

The Act also provides for codes of practice. These include a data-sharing code, direct marketing code, age-appropriate design code, and data protection and journalism code. The codes are important because they translate statutory requirements into operational guidance for specific recurring contexts.

The Commissioner also has functions relating to consensual audits, national security certificates, confidentiality of information, fees, charges payable by controllers, reporting to Parliament, publication and notices.

Enforcement — Part 6

Part 6 gives the Commissioner strong enforcement powers. These include information notices, information orders, assessment notices, enforcement notices, penalty notices, powers of entry and inspection, and guidance about regulatory action.

Section 155 allows penalty notices where the Commissioner is satisfied that a person has failed or is failing to comply with specified provisions. Section 157 sets the maximum penalty framework. Schedule 16 gives further detail on penalties.

Data subjects may complain to the Commissioner under section 165. The Act also provides for court remedies, including compliance orders and compensation for contraventions of the GDPR or other data protection legislation.

Personal data offences

The DPA 2018 contains offences relating to personal data. Section 170 concerns unlawful obtaining, disclosure, procuring disclosure or retention of personal data without the controller's consent. Section 171 concerns re-identification of de-identified personal data. Section 173 concerns alteration, defacing, blocking, erasing, destruction or concealment of personal data with intent to prevent disclosure following a data subject access request.

These offences are important because the UK's framework is not limited to administrative enforcement. Certain misconduct involving personal data can trigger criminal liability, particularly where data is obtained, disclosed, retained, re-identified or altered unlawfully.

Territorial application, Crown and Parliament

Part 7 contains supplementary provisions, including territorial application, application to the Crown and application to Parliament. The Act also includes rules on representation of data subjects, the Framework for Data Processing by Government, offences, prosecutions, liability of directors and interpretation.

The UK framework is therefore both broad and layered. General organisations usually focus on UK GDPR plus Part 2 and Part 6. Police and criminal justice bodies must analyse Part 3. Intelligence services must analyse Part 4. Public bodies and organisations handling journalistic, research, health, education, child protection, national security or criminal offence data must check the relevant schedules and exemptions carefully.