Key Facts
- Regulator
- Information Commission (successor to the Information Commissioner's Office from 30 September 2026)
- Latest version
- Data Protection Act 2018 (2018 c. 12), latest revised version as amended, including by the Data (Use and Access) Act 2025; up to date to 15 October 2026 on legislation.gov.uk
- Effective
- 23 May 2018
- Official text
- www.legislation.gov.uk ↗
What is the Data Protection Act 2018?
The Data Protection Act 2018 is the UK statute that regulates the processing of personal data and supplements the UK GDPR. The UK Parliament made it (2018 c. 12), and the Information Commission enforces it. It applies to everyone responsible for using personal data in the UK, from businesses to government departments.
The Information Commission took over from the Information Commissioner's Office (ICO) on 30 September 2026. The regulator's role, responsibilities and powers did not change.
The text on legislation.gov.uk is the latest revised version as amended, including by the Data (Use and Access) Act 2025, and it is up to date to 15 October 2026. Section 1 came into force at Royal Assent, and the first dated version on that site is 23 May 2018. The Act replaced the Data Protection Act 1998.
There has been no wholesale revision. Amendments continue to be applied: some provisions of the Data (Use and Access) Act 2025 came into force on 17 November 2025, with further changes from 30 September 2026. More may be brought into force at a future date.
Why it matters
A prospect's due-diligence form asks which data protection law you work under and who regulates you. The answer names two documents, the UK GDPR and the Data Protection Act 2018, and the form rarely says which one it means.
The split matters in practice. The principles and most individual rights come from the UK GDPR. The conditions, exemptions and enforcement powers you rely on come from the Act.
Breaching the principles attracts the highest tier of fines: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
A privacy notice that matches no real process is a statement you can't defend.
Who it applies to
The Data Protection Act 2018 is mandatory, because it is a statute. Everyone responsible for using personal data in the UK has to follow the data protection principles unless an exemption applies.
Two groups sit under separate regimes. Part 3 sets the rules for processing by competent authorities for law enforcement purposes. Part 4 covers processing by the intelligence services. A typical commercial firm sits under the general regime, which the UK GDPR leads and the Act supplements.
Section 207 sets the Act's territorial reach. For the general regime it follows Article 3 of the UK GDPR. For the other Parts it covers processing in the context of a UK establishment of a controller or processor, whether or not the processing takes place in the UK.
The Act is law, and ISO/IEC 27001 is a voluntary management-system standard. A certificate shows you run an information security management system; it does not show that you comply with the Act. The nearest Annex A control is A.5.34 Privacy and protection of PII, and the ISO 27001 vault has the control-level view.
The UK position
UK data protection law is made up of the UK GDPR and the Data Protection Act 2018, as gov.uk sets out. Four related regimes matter alongside the Act:
| Regime | How it relates to the Act |
|---|---|
| UK GDPR | Covers most processing of personal data in the UK. The Act supplements it. |
| Data (Use and Access) Act 2025 | Amends the Act and the UK GDPR in stages, and set up the Information Commission. |
| Privacy and Electronic Communications Regulations 2003 (PECR) | Covers electronic marketing messages and cookies. Schedule 19 of the Act amends it. |
| Data Protection (Charges and Information) Regulations 2018 | The fee controllers pay the regulator, provided for in section 137 of the Act. |
For a UK firm, this is the home regime. The question is which parts apply to what you do.
Key requirements
The Act is organised by the kind of processing it governs and by how the rules are enforced:
- General processing (Part 2). Supplements the UK GDPR, with conditions for using special category and criminal offence data (Schedule 1) and exemptions from the UK GDPR (Schedules 2 and 3).
- Law enforcement (Part 3). A separate regime for processing by competent authorities for law enforcement purposes.
- Intelligence services (Part 4). A separate regime for processing by the intelligence services.
- The regulator (Part 5). Sets up the Information Commission and its functions, and the charges controllers pay it.
- Enforcement (Part 6). Information, assessment and enforcement notices, powers of entry and inspection, and penalty notices.
- Repeals and amendments (Schedule 19). The Data Protection Act 1998 is repealed, with limited exceptions, and PECR is amended.
The data protection principles
The duties most organisations meet first are the principles. Article 5 of the UK GDPR sets out seven, and the ICO's guide to the data protection principles explains each one:
- lawfulness, fairness and transparency;
- purpose limitation;
- data minimisation;
- accuracy;
- storage limitation;
- integrity and confidentiality (security);
- accountability.
Individuals also hold rights over their personal data, with some exceptions.
Accountability is the principle that asks you to prove the other six.
Frequently asked questions
The main data protection law for the UK is the UK GDPR read together with the Data Protection Act 2018. Section 1 of the Data Protection Act 2018 says most processing is subject to the UK GDPR, which Part 2 supplements. Part 7 applies the Act to the Crown and to Parliament, so government bodies are covered as well as businesses.
There are seven, set out in Article 5 of the UK GDPR, which the Data Protection Act 2018 supplements. The seventh, accountability, makes the controller responsible for, and able to demonstrate, compliance with the other six. In practice that means records and evidence, not only a policy, when the regulator asks.
Yes. Schedule 19 of the Data Protection Act 2018 repeals the Data Protection Act 1998, with limited exceptions. A contract, privacy notice or policy that still cites the 1998 Act as current law is out of date, and should name the UK GDPR and the Data Protection Act 2018 instead.
The Data Protection Act 2018 protects personal information: how organisations use it, and the rights individuals hold over it, with some exceptions. It is important because individuals who think their data is mishandled can complain to the regulator, and a complaint can lead to investigation and enforcement under Part 6 of the Act.
Yes. The Data (Use and Access) Act 2025 amends the Data Protection Act 2018 and the UK GDPR in stages, and more changes may be brought into force later. The ICO's guidance is under review as a result, so check the current revised text on legislation.gov.uk rather than a summary saved before the amendments.