UK Data Protection Act (DPA) 2018

Why does it matter?

A business handling personal data in the UK answers to two texts. The UK GDPR sets the main duties, and the Act supplies the conditions for sensitive data, the exemptions, the specific regimes for law enforcement and intelligence processing, the enforcement powers and the criminal offences. For the most serious infringements, and for ignoring an information, assessment, interview or enforcement notice, a penalty notice under section 155 can reach 17.5 million pounds or 4 percent of worldwide annual turnover, whichever is higher; the standard maximum is 8.7 million pounds or 2 percent (section 157). Individuals can also be prosecuted under sections 170, 171 and 173.

Key benefits include:

• Conditions for sensitive data

Section 10 and Schedule 1 list the conditions for processing special category and criminal convictions data; the substantial public interest conditions generally require an appropriate policy document (Schedule 1, Part 4).

• Named exemptions

Schedules 2 to 4 set out exemptions, from crime and taxation and legal professional privilege to management forecasts, confidential references and exam marks.

• A complaints route

Since June 19, 2026, section 164A requires a controller to make complaints easy to submit and to acknowledge each one within 30 days.

• Personal criminal liability

Section 170 covers unlawful obtaining, section 171 re-identification of de-identified data and section 173 altering or destroying information to defeat a subject access request.

• Graduated regulator powers

Information notices (section 142), assessment notices (146), interview notices (148A), enforcement notices (149) and penalty notices (155) give the Commission a ladder of tools.

How does it work?

Part 2 does not restate the UK GDPR; it fills gaps the UK GDPR leaves to domestic law. Section 8 says the public interest basis in Article 6(1)(e) includes the administration of justice, a function of Parliament, a function conferred by enactment, a function of the Crown or a government department, and activity that supports democratic engagement. Section 10 says processing under Article 9(2)(b), (h), (i) or (j) needs a Part 1 condition in Schedule 1, processing under Article 9(2)(g) needs a Part 2 condition, and criminal convictions data under Article 10 needs a condition from Part 1, 2 or 3.

Section 15 introduces the exemptions: Schedule 2 restricts or adapts Articles 13 to 21 and 34 in specified circumstances, Schedule 3 covers health, social work, education and child abuse data, and Schedule 4 covers data whose disclosure another enactment prohibits. Section 26 lets a controller disapply listed UK GDPR provisions where required to safeguard national security or for defense purposes, and section 27 provides for a national security certificate. Part 3 applies to a competent authority, listed in Schedule 7 or holding statutory functions for law enforcement purposes (section 30), and Part 4 to the Security Service, the Secret Intelligence Service and GCHQ (section 82).

Part 6 is the enforcement toolkit. The Commission can issue the notices above, enter premises under an assessment notice, and issue a penalty notice after a notice of intent, having regard to the factors in section 155(3). Individuals can seek compliance orders (section 167) and compensation, where section 168 confirms that non-material damage includes distress, and can complain to the controller (164A) or the Commission (165).

Key Elements

• Part 2 supplement (sections 4 to 28)

The Act applies to the processing the UK GDPR covers and must be read with it; it adds Schedule 1 conditions, exemptions and the national security and defense exemption.

• Special category conditions (section 10, Schedule 1)

Part 1 employment, health, public health and research; Part 2 substantial public interest conditions; Part 3 criminal convictions; Part 4 the appropriate policy document and record of processing.

• Exemptions (section 15, Schedules 2 to 4)

From crime and taxation to legal professional privilege, negotiations, self-incrimination, journalistic purposes and research, plus health, social work and education data.

• Law enforcement regime (Part 3)

Six data protection principles (sections 35 to 40), data subject rights (43 to 54), data protection impact assessments (64), breach notification (67) and data protection officers (69).

• Intelligence services regime (Part 4)

Its own principles, rights and security duties for the Security Service, the Secret Intelligence Service and GCHQ, and for authorities under a designation notice.

• The Information Commission (Part 5)

Section 114A establishes the Commission as a body corporate; section 119A lets it issue standard data protection clauses for transfers, laid before Parliament for 40 days.

What does it cover?

Part 2 applies to the types of processing the UK GDPR covers under Article 2 (section 4). Part 3 applies to processing by a competent authority for the law enforcement purposes, whether by automated means or in a filing system (sections 29 to 31), and Part 4 to the intelligence services and to processing by a qualifying competent authority under a designation notice (sections 82 to 82E). Section 3 defines the core terms: personal data is information relating to an identified or identifiable living individual, and a data subject is that individual. Under section 214 the Act extends to England and Wales, Scotland and Northern Ireland.

What are its objectives?

The Act pursues the objectives its opening sections state.

Protect individuals with regard to the processing of personal data, requiring lawful and fair processing (section 2).

Supplement the UK GDPR with the domestic conditions, exemptions and safeguards it leaves to national law.

Set standalone rules for law enforcement and intelligence services processing in Parts 3 and 4.

Make one regulator, the Information Commission, responsible for monitoring and enforcing the legislation.

Back the rules with notices, penalties, compliance orders and criminal offences.

Framework in Context

The Act implements and sits beside the UK GDPR, which holds the principles, the rights and the controller and processor duties. The Act repealed the Data Protection Act 1998 (Schedule 19, paragraph 44), and as enacted it defined the EU Law Enforcement Directive for its Part 3 regime. Since 2021 the UK GDPR has been the retained version of the EU regulation, and the Data (Use and Access) Act 2025 has amended both texts, adding recognized legitimate interests, new automated decision-making rules and a complaints duty. The Commission publishes guidance and codes under Part 5, including the data-sharing, direct marketing and age-appropriate design codes (sections 121 to 123).

Common Framework Mappings

Organizations map the Act's provisions to the frameworks below so that one record of processing, one set of assessments and one evidence trail serve the UK regime, other privacy laws and security audits.

Mapped frameworks include:

APEC PF

CCPA/CPRA

GDPR

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines

SOC 2