The UK Data Protection Act 2018 is the primary UK legislation governing the processing of personal data, implementing and supplementing the UK GDPR and providing the legal framework for data subjects’ rights and controllers’ obligations. It sets lawful bases for processing, principles such as data minimisation and purpose limitation, and is enforced by the Information Commissioner’s Office.
Content
- The Act covers general processing, law enforcement, and intelligence-service regimes, alongside provisions for special-category data and exemptions. Compliance obligates organisations to uphold the data-protection principles, conduct impact assessments, and respond to rights requests, with significant penalties for breaches.