Data Protection Act 2018
Data Protection Act 2018 (c. 12)
The Data Protection Act 2018 is the UK's national data protection law that supplements the UK GDPR and implements rules for areas outside its scope, including law enforcement and intelligence services processing. Together with the UK GDPR it forms the UK's data protection framework. It was substantially amended by the Data (Use and Access) Act 2025, which also turned the Information Commissioner's Office into the Information Commission from 30 September 2026.
Who it applies to
Organizations and public authorities processing personal data in the UK, including general processing under the UK GDPR, law enforcement processing, and intelligence services processing.
Identity requirements
- Provide additional conditions for processing special category and criminal offence identity data
- Apply exemptions and safeguards that affect handling of identity data
- Set appropriate security measures for law enforcement and other regulated processing
- Support individual rights and access requests in conjunction with the UK GDPR
- Enable ICO enforcement, audit, and accountability powers over identity data processing
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Sets extra conditions and safeguards for processing sensitive and criminal-offence identity data. |
| Audit, logging & accountability | Underpins ICO audit and enforcement powers and accountability over identity data processing. |
| Identity governance (IGA) | Defines exemptions and special-category conditions that shape governance of identity attributes. |
| Breach notification | Supports the UK breach-reporting regime applied alongside the UK GDPR. |
Penalties
Enforced via the ICO using UK GDPR fine levels of up to 17.5 million pounds or 4 percent of worldwide annual turnover, plus specific offences under the Act.
Status and dates last verified against primary sources on 2026-10-31.
Data Protection Act 2018: frequently asked questions
- What does the Data Protection Act 2018 do?
- It supplements the UK GDPR and sets national rules for areas outside its scope, such as law enforcement and intelligence processing, plus exemptions and conditions for sensitive data.
- How does the DPA 2018 relate to the UK GDPR?
- The two operate together: the UK GDPR sets the main framework while the DPA 2018 tailors it for the UK and covers processing the UK GDPR does not.
- Who enforces the Data Protection Act 2018?
- The Information Commission enforces the Act. It replaced the corporation sole of the Information Commissioner on 30 September 2026 under the Data (Use and Access) Act 2025, still trades as the ICO, and keeps the same powers to investigate, audit and fine.