Data Protection Act 2018

Short description: Act of the Parliament of the United Kingdom

Short description: United Kingdom legislation

Data Protection Act 2018[lower-alpha 1]Act of Parliament

Parliament of the United Kingdom

Long title| An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.
Citation| 2018 c. 12
Introduced by| Matt Hancock (Commons)
Henry Ashton, 4th Baron Ashton of Hyde (Lords)
Territorial extent| United Kingdom[lower-alpha 2]
Dates
Royal assent| 23 May 2018
Commencement| Fully in force as of 2 December 2019[lower-alpha 3][1]
Other legislation
Amends|

* Scottish Public Services Ombudsman Act 2002
* Domestic Violence, Crime and Victims Act 2004
* Public Audit (Wales) Act 2004
* Mental Capacity Act 2005
* Criminal Justice and Immigration Act 2008
* Borders, Citizenship and Immigration Act 2009
* Protection of Freedoms Act 2012
* Modern Slavery Act 2015
* Counter-Terrorism and Security Act 2015
* Investigatory Powers Act 2016
* Digital Economy Act 2017

Repeals| Data Protection Act 1998
Amended by|

* Public Services Ombudsman (Wales) Act 2019
* Sentencing Act 2020
* Armed Forces Act 2021
* Advanced Research and Invention Agency Act 2022
* Health and Social Care Act 2022
* Border Security, Asylum and Immigration Act 2025
* Employment Rights Act 2025

Relates to|

* General Data Protection Regulation
* Data Protection Act 1998

Status: Amended

History of passage through Parliament
Text of statute as originally enacted
Text of the Data Protection Act 2018 as in force today (including any amendments) within the United Kingdom, from legislation.gov.uk.
Revised text of statute as amended

The Data Protection Act 2018 (c. 12) is an act of the Parliament of the United Kingdom which updates data protection laws in the UK. It is a national law which complements the European Union's General Data Protection Regulation (GDPR) and replaces the Data Protection Act 1998.

The act was to be significantly amended by the Data Protection and Digital Information Bill. That bill was abandoned due to the 2024 United Kingdom general election,[2] but the phased implementation of the Data (Use and Access) Act 2025 will make changes to the operation of the 2018 Act.[3]

## Contents

* 1 Background
* 2 Contents
* 3 Additions
* 4 Notes
* 5 References
* 6 External links

## Background

The Data Protection Bill was introduced to the House of Lords by Lord Ashton of Hyde, Parliamentary Under-Secretary of State at the Department for Digital, Culture, Media and Sport on 13 September 2017.[4]

The Data Protection Act 2018 received royal assent on 23 May 2018. The Act came into effect on 25 May 2018. It was amended on 1 January 2021 by regulations under the European Union (Withdrawal) Act 2018, to reflect the UK's status outside the EU. It replaces the Data Protection Act 1998.[5]

The Act applies the data protection standards set out in the GDPR and, where the GDPR allows EU member states to make different choices for its implementation in their country, defines those choices for the UK.[6]

## Contents

The act has seven parts. These are outlined in Section 1:[7]

1. This act makes provision about the processing of personal data.
2. Most processing of personal data is subject to GDPR.
3. Part 2 supplements the GDPR (see Chapter 2) and applies a broadly equivalent regime to certain types of processing to which the GDPR does not apply (see chapter 3).
4. Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes and implements the Law Enforcement Directive.
5. Part 4 makes provision about the processing of personal data by the intelligence services.
6. Part 5 makes provision about the Information Commissioner.
7. Part 6 makes provision about the enforcement of the data protection legislation.
8. Part 7 makes supplementary provision, including provision about the application of this act to the Crown and to Parliament.

The act introduces new offences that include knowingly or recklessly obtaining or disclosing personal data without the consent-giving of the data controller, procuring such disclosure, or retaining the data obtained without consent. Selling, or offering to sell, personal data knowingly or recklessly obtained or disclosed would also be an offence.[8]

Essentially, the act implements the EU Law Enforcement Directive,[9] it implements those parts of the GDPR which "are to be determined by Member State law" and it creates a framework similar to the GDPR for the processing of personal data which is outside the scope of the GDPR. This includes intelligence services processing, immigration services processing and the processing of personal data held in unstructured form by public authorities.

Under section 3 of the European Union (Withdrawal) Act 2018,[10] the GDPR will be incorporated directly into domestic law immediately after the UK exits the European Union.

The enforcement of the act by the Information Commissioner's Office is supported by a data protection charge on UK data controllers under the Data Protection (Charges and Information) Regulations 2018. Exemptions from the charge were left broadly the same as for 1998 act: largely some businesses and non-profits internal core purposes (staff or members, marketing and accounting), household affairs, some public purposes, and non-automated processing.[11][12] Under the 2018 act, the enforcement regime for registration changed from criminal to civil monetary penalties.[13]

The act introduces a new public interest test applicable to the research processing of personal health data.[14]

The act gave people the right to apply to courts and tribunals for different orders, including: in the tribunal by ordering the Information Commissioner to conduct an investigation (section 166); in the court for compliance orders against the Commissioner or controllers or processors (section 167); in the tribunal against penalty notices and other enforcement decisions (section 162). The jurisdiction of these sections and their extent and limits have been the subject of a campaign of litigation arguing their different extent and limits, including as high as the Court of Appeal.[15][16][17][18]

## Additions

The Data Protection Act 2018 is a revision of the Data Protection Act 1998 which includes the importance of organizations to be more responsible with the information as well as improving the confidentiality.[19] The latter revision also works in tandem with the GDPR, which the Data Protection Act 1998 did not do.[20]

From the Data Protection Act 1998 to the Data Protection Act 2018, the key additions are the following:[19]

* the right to erasure
* inclusions of exemptions of the Data Protection Act
* being regulated in tandem with the GDPR

The revision allowed the law makers to add the ability to erase any data if the individual chooses to and this is based on the premise of the basic right to privacy.[19]

The 2018 version allowed people to get a clear interpretation of the exemptions of the act, which was unclear in the 1998 version.[20]

When the Data Protection Act 1998 was being made, the GDPR did not exist, thus there was no law for the DPA to work with.[clarification needed] Eventually, with the creation of the GDPR, the DPA was updated to work in tandem.[21]

## Notes

1. ↑ Section 215.
2. ↑ Section 214.
3. ↑ Section 212.

## References

1. ↑ The Data Protection Act 2018 (Commencement No. 3) Regulations 2019, The National Archives, SI 2019/1434, http://legislation.gov.uk/uksi/2019/1434/made
2. ↑ Whannel, Kate (25 May 2024). "Which laws were passed in final days of Parliament?". BBC News. https://www.bbc.co.uk/news/articles/cd11d37rpw9o.
3. ↑ Department for Science, Innovation and Technology, Data (Use and Access) Act factsheet: UK GDPR and DPA, published on 27 June 2025, accessed on 28 October 2025
4. ↑ Template:OPL-attribution
5. ↑ This article incorporates text published under the British Open Government Licence: "About the DPA 2018". 18 January 2022. https://ico.org.uk/for-organisations/guide-to-data-protection/introduction-to-dpa-2018/about-the-dpa-2018/.
6. ↑ "Data Protection Act 2018 Factsheet – Overview". Department for Digital, Culture, Media and Sport. 23 May 2018. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/711162/2018-05-23_Factsheet_1_-_Act_overview.pdf.
7. ↑ "Data Protection Act 2018". http://www.legislation.gov.uk/ukpga/2018/12/section/1. 30px This article contains quotations from this source, which is available under the Open Government Licence v3.0. © Crown copyright.
8. ↑ "New Data Protection Act finalised in the UK" (in en). https://www.out-law.com/en/articles/2018/may/new-data-protection-act-finalised-uk/.
9. ↑ Directive (EU) 2016/680 of the European Parliament and of the Council
10. ↑ "European Union (Withdrawal) Act 2018". http://www.legislation.gov.uk/ukpga/2018/16/section/3/enacted.
11. ↑ ﻿Review of exemptions from paying charges to the Information Commissioner's Office﻿ (Report). Department for Digital, Culture, Media and Sport. November 2018. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/754690/Government_response_to_the_ICO_Charge_Exemption_Consultation_L.pdf. Retrieved 30 April 2020.
12. ↑ "The Data Protection (Charges and Information) Regulations 2018 - Schedule Exempt Processing". legislation.gov.uk. https://www.legislation.gov.uk/ukdsi/2018/9780111165782/schedule.
13. ↑ "ICO issues the first fines to organisations that have not paid the data protection fee". Information Commissioner’s Office. 28 November 2018. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/11/ico-issues-the-first-fines-to-organisations-that-have-not-paid-the-data-protection-fee/.
14. ↑ Taylor, Mark J.; Whitton, Jess (2020). "Public Interest, Health Research and Data Protection Law: Establishing a Legitimate Trade-Off between Individual Control and Research Access to Health Data". Laws (MDPI) 9 (1): 6. doi:10.3390/laws9010006. This article incorporates text from this source, which is available under the CC BY 4.0 license.
15. ↑ James Killock and Michael Veale v ICO (Information rights - Freedom of Information - exceptions : practice and procedure) [2021 UKUT 299 (AAC)], 24 November 2021, https://www.bailii.org/uk/cases/UKUT/AAC/2021/299.html, retrieved 2024-02-24
16. ↑ "Our Adtech challenge: what we won, what we lost and what we do next" (in en). https://www.openrightsgroup.org/blog/our-adtech-challenge-what-we-won-what-we-lost-and-what-we-do-next/.
17. ↑ Delo, R (On the Application Of) v Information Commissioner & Anor [2022 EWHC 3046 (Admin)], 2 December 2022, https://www.bailii.org/ew/cases/EWHC/Admin/2022/3046.html, retrieved 2024-02-24
18. ↑ Delo, R (On the Application Of) v The Information Commissioner (Rev1) [2023 EWCA Civ 1141], 10 October 2023, https://www.bailii.org/ew/cases/EWCA/Civ/2023/1141.html, retrieved 2024-02-24
19. ↑ 19.0 19.1 19.2 Zaheer, Adnan. "Data Protection Act 1998 - Be Compliant | Seers" (in EN). https://seersco.com/articles/data-protection-act-2018-vs-data-protection-act-1998/.
20. ↑ 20.0 20.1 "About the DPA 2018" (in en). 2020-09-28. https://ico.org.uk/for-organisations/guide-to-data-protection/introduction-to-data-protection/about-the-dpa-2018/.
21. ↑ "Data Protection Act 2018" (in en). 2020-07-20. https://ico.org.uk/for-organisations/data-protection-act-2018/.

## External links

* Text of the Data Protection Act 2018 as in force today (including any amendments) within the United Kingdom, from legislation.gov.uk.
* Text of the Data Protection Act 2018 as originally enacted or made within the United Kingdom, from legislation.gov.uk.
* Information Commissioner's Office DPA 2018 page

* v
* t
* e

Legislation of the United Kingdom

Pre-Parliamentary legislation|

* List of English statutes
* Charter of Liberties
* Magna Carta

Acts of Parliament by states preceding
the Kingdom of Great Britain|

| Parliament of England|

* to 1483
* 1485–1601
* 1603–1641
* Petition of Right
* Interregnum (1642–1660)
* 1660–1699
* Habeas Corpus Act
* Bill of Rights
* 1700–1706

|

Parliament of Scotland|

* to 1707

Acts of Parliament of the
Kingdom of Great Britain|

* 1707–1719
* 1720–1739
* 1740–1759
* 1760–1779
* 1780–1800

Acts of the Parliament of Ireland|

* to 1700
* 1701–1800

Acts of Parliament of the United Kingdom of
Great Britain and Ireland and the United
Kingdom of Great Britain and Northern Ireland|

* 1801–1819
* 1820–1839
* 1840–1859
* 1860–1879
* 1880–1899
* 1900–1919
* 1920–1939
* 1940–1959
* 1960–1979
* 1980–1999
* 2000–2019
* 2020 to date
* Halsbury's Statutes
* Legislation.gov.uk
* Short titles

| relating to the European Union (formally European Communities)|

* 1972 to date

|

Church of England measures|

* List
* Church of England Assembly (Powers) Act 1919

Legislation of devolved institutions|

* Acts of the Scottish Parliament
* List
* Acts and Measures of the National Assembly for Wales
* List
* Acts of the Northern Ireland Assembly
* Acts of the Parliament of Northern Ireland

Orders in Council|

* 1994 to date

| for Northern Ireland|

* 1972–2009

|

Secondary legislation|

* United Kingdom statutory instruments
* Scottish statutory instruments
* Acts of Sederunt
* Acts of Adjournal

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Data Protection Act 2018. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Data_Protection_Act_2018&oldid=4299879"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template