Data Protection Act 2018 (United Kingdom)
UK law updating data protection rules for personal information, implementing EU-style protections and defining rights, responsibilities, exemptions and enforcement for controllers and processors.
Overview
The Data Protection Act 2018 is the United Kingdom's primary statute for the protection of personal information. It modernised and replaced earlier legislation to reflect developments in technology and data processing and to implement key elements of the EU General Data Protection Regulation. The Act regulates how personal data about living individuals may be collected, stored, used and shared by organisations and public bodies.
Scope and key principles
The Act applies to information that identifies, or could identify, a living person and covers data held electronically and certain structured manual records. Its core principles require that personal data be processed lawfully, fairly and transparently; collected for specified purposes; adequate, relevant and limited; accurate and kept up to date; stored no longer than necessary; and processed in a way that ensures appropriate security.
Rights of individuals
People whose data is processed—known as data subjects—are granted statutory rights. These include the right to access personal data, request correction or deletion, restrict or object to processing, and in many cases obtain a copy of their data in a portable format. The Act also recognises heightened protections for sensitive or "special category" data such as health records, racial or ethnic origin, political opinions and similar information.
Duties, lawful bases and roles
Organisations that determine purposes and means of processing are called data controllers; those that process data on controllers' behalf are processors. Processing must rest on a lawful basis such as consent, contract performance, compliance with a legal duty, protection of vital interests, carrying out public functions or legitimate interests. Some controllers are required to appoint a Data Protection Officer or maintain records of processing activities.
Enforcement, exemptions and practical effects
The Information Commissioner's Office provides guidance and enforces compliance, investigating breaches and issuing penalties where appropriate. The Act includes specific exemptions for areas such as national security, crime prevention and certain journalistic, artistic or literary purposes. Its provisions affect everyday activities from employee record keeping to marketing, and require organisations to consider privacy at the design stage.
Legislative context and further guidance
The Data Protection Act 2018 was enacted to bring domestic law into alignment with contemporary standards and international obligations. For official legislative texts and explanatory notes consult the government pages via government resources and the statute on the legislation site at legislation. Practical guidance for organisations and individuals about data handling and rights can be found through regulatory guidance at guidance and technical storage considerations at storage guidance.
- Terminology: data subject, data controller, data processor.
- Important concepts: lawful basis, privacy by design, special category data.
- Where to get help: the national data protection regulator and official guidance links above.
Questions and answers
Q: What is the Data Protection Act 2018?
A: The Data Protection Act 2018 is a law passed by the British government in 2018, and it replaces the one passed in 1998. It sets out rules for people who use or store data about living people and gives rights to those people whose data has been collected.
Q: What types of data does the law apply to?
A: The law applies to personal data which are facts like your address, telephone number, e-mail address, job history, etc.
Q: What types of storage systems does the law cover?
A: The law applies to data held on computers or any sort of storage system, even paper records.
Q: What are the people who use the information called?
A: People who use the information are called data controllers.
Q: What do you call the people who the data is about?
A: People who the data is about are called data subjects.
Q: Does the Data Protection Act 2018 give any rights to those whose data has been collected?
A: Yes, the Data Protection Act 2018 gives rights to those people whose data has been collected.
Q: What rights are given to people whose data has been collected under the Data Protection Act 2018?
A: The Data Protection Act 2018 gives rights to people whose data has been collected, such as the right to access their information, the right to have their information corrected or erased, and the right to object to their information being used for certain purposes.
Related articles
Author
AlegsaOnline.com Data Protection Act 2018 (United Kingdom) Leandro Alegsa
URL: https://en.alegsaonline.com/art/25638