UK Data Protection Act
The UK's supplementary data protection legislation alongside UK GDPR.
What is the UK Data Protection Act 2018?
The Data Protection Act 2018 (DPA 2018) is the UK's primary data protection legislation. It supplements and tailors the UK GDPR for the UK context, providing additional provisions on law enforcement processing, intelligence services processing, and specific exemptions. Together with the UK GDPR, it forms the UK's complete data protection framework.
How does the DPA 2018 relate to UK GDPR?
The UK GDPR provides the core data protection principles and rights. The DPA 2018 supplements it by filling in areas where the GDPR allows member states to make specific provisions, such as the age of consent for children's data (set at 13 in the UK), exemptions for journalism and research, and rules for law enforcement and intelligence services processing.
Who enforces the Data Protection Act 2018?
The Information Commissioner's Office (ICO) enforces both the DPA 2018 and UK GDPR. The ICO has powers to investigate complaints, conduct audits, issue enforcement notices, impose fines, and prosecute criminal offences under the Act.
What are the penalties under the DPA 2018?
The maximum fine is 17.5 million pounds or 4% of annual global turnover, whichever is higher — the same as under UK GDPR. The DPA 2018 also creates criminal offences, including knowingly or recklessly obtaining personal data without consent, and re-identification of de-identified data.
Does the DPA 2018 apply after Brexit?
Yes. After Brexit, the UK retained its data protection framework by incorporating the EU GDPR into UK law as the UK GDPR, supplemented by the DPA 2018. The framework is substantively similar to the EU regime, and the EU has granted the UK an adequacy decision, allowing data to flow freely between the EU and UK.
What age of consent does the DPA 2018 set for children?
The DPA 2018 sets the age of consent for children's data at 13 years old in the UK. Below this age, processing of a child's personal data for online services requires parental or guardian consent. The EU GDPR allows member states to set this between 13 and 16.
What exemptions does the DPA 2018 provide?
The DPA 2018 includes exemptions for journalism, academic research, and artistic purposes where compliance would be incompatible with those activities. It also provides specific rules for law enforcement processing (Part 3) and intelligence services processing (Part 4), which are outside the scope of the GDPR.
Do I need to register with the ICO?
Most organisations that process personal data must pay an annual data protection fee to the ICO. There are some exemptions for organisations that only process personal data for core business purposes such as staff administration, accounts, and advertising. The ICO maintains a public register of fee-paying organisations.
What is the difference between DPA 2018 and UK GDPR?
The UK GDPR provides the overarching data protection framework — principles, lawful bases, individual rights, and accountability requirements. The DPA 2018 fills in the UK-specific details: the age of consent for children, exemptions for journalism and research, rules for law enforcement, criminal offences, and ICO powers. You need to comply with both.
How does the DPA 2018 affect international data transfers?
The DPA 2018 works alongside UK GDPR provisions on international transfers. Personal data can be transferred outside the UK to countries with an adequacy finding, or where appropriate safeguards are in place (standard contractual clauses, binding corporate rules). The UK has its own adequacy assessment process separate from the EU's.