Data Protection Act 2018
The Data Protection Act 2018 (DPA 2018) is the United Kingdom’s data protection legislation, which implemented the General Data Protection Regulation (GDPR) and replaced the Data Protection Act 1998. The Act repealed and replaced the majority of the 1998 Act, bringing UK data protection law into line with modern data processing practices. The Act provides the legal framework for the UK’s implementation of the GDPR (the ‘UK GDPR’), sets out exemptions and derogations, regulates law enforcement data processing (Part 3), and governs intelligence services data processing (Part 4). The Act also established the Information Commissioner’s Office’s enforcement powers, including the power to impose substantial fines.
Legal area: Cyber law (information technology law) governs digital activities including data protection, privacy, surveillance, and the regulation of online content and communications.
Citation: Data Protection Act 2018 (2018 c 12)
Full text: https://www.legislation.gov.uk/ukpga/2018/12
Key Provisions
- Part 1: Overview and key definitions
- Part 2: General processing (supplements UK GDPR with exemptions and modifications)
- Part 3: Law enforcement processing (separate regime for criminal justice)
- Part 4: Intelligence services processing
- Part 5: Information Commissioner (powers and duties)
- Schedule 1: Conditions for processing special categories of personal data
- Schedule 2: Exemptions from the UK GDPR
Significance
The DPA 2018 is a cornerstone of UK digital rights law, governing how personal data is collected, processed, stored, and shared. The Act gives individuals rights of access, rectification, erasure, restriction, portability, and objection. The Information Commissioner’s Office has imposed significant fines under the Act, including against British Airways (20 million, reduced from 183 million) and Marriott International (18.4 million, reduced from 99 million). Following Brexit, the UK was granted an adequacy decision by the EU, allowing continued data flows. The Act was amended by the Data Protection (Adequacy) (EU) Regulations 2023.