Meet DPA 2018 and UK GDPR duties with evidence ready to show

The Data Protection Act 2018 is the UK's main data protection statute. It works alongside the UK GDPR, adding UK-specific rules such as conditions for processing special category and criminal offence data, exemptions, the age of consent for online services, and the regulator's enforcement powers. It also sets separate regimes for law enforcement and intelligence services processing. It was last substantially amended by the Data (Use and Access) Act 2025.

The UK GDPR sets the core rules: the principles, lawful bases, data subject rights and controller duties. The DPA 2018 supplements and tailors it for the UK, setting out exemptions, Schedule 1 conditions for sensitive data, rules for law enforcement and intelligence services, criminal offences and the regulator's powers. Most organisations must comply with both together, so a UK compliance programme reads them side by side rather than choosing one.

Any organisation that processes personal data in the UK must comply, whether it is a business, charity or public body, and whether it acts as a controller or a processor. Organisations outside the UK can also be caught by the UK GDPR when they offer goods or services to people in the UK or monitor their behaviour. Only purely personal or household processing falls outside the law.

The Data (Use and Access) Act 2025 amended the UK GDPR, the DPA 2018 and PECR. Most data protection changes took effect on 5 February 2026, including recognised legitimate interests, wider lawful bases for automated decision-making with safeguards, reasonable and proportionate searches for subject access requests, and some cookies that no longer need consent. A duty to handle data protection complaints applied from 19 June 2026.

The regulator can issue information, assessment and enforcement notices, and penalty notices of up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious UK GDPR infringements. The DPA 2018 also creates criminal offences, such as knowingly or recklessly obtaining personal data without the controller's consent and altering records to prevent disclosure to a data subject. Individuals can claim compensation in the courts.

The Information Commission enforces the DPA 2018 and the UK GDPR. It took over the functions of the Information Commissioner's Office (ICO) on 30 September 2026, under reforms made by the Data (Use and Access) Act 2025. It handles complaints, investigates breaches, publishes codes of practice and guidance, and can issue notices and fines. It is the UK's independent regulator for data protection and electronic marketing rules.

Yes. Since 19 June 2026, section 164A requires controllers to help people make data protection complaints, for example with a complaint form that can be completed electronically. You must acknowledge each complaint within 30 days, make appropriate enquiries, keep the complainant informed of progress and tell them the outcome without undue delay. People can still complain to the Information Commission afterwards.

The Data Protection Act 2018 is mapped in OneClickComply's control library and available on request. OneClickComply helps you collect evidence automatically, generate data protection and security policies from your real environment, monitor technical controls continuously and reuse evidence across UK GDPR and ISO 27001. Our in-house audit team can advise through Ask an Auditor. OneClickComply does not certify or guarantee legal compliance.