United Kingdom. Comprehensive data protection. Act
DPA 2018Data Protection Act 2018
§1Summary
- Synopsis
Supplements the UK GDPR with exemptions, conditions for special category and criminal offence data, and the ICO's powers, and separately regulates law enforcement (Part 3) and intelligence services (Part 4) processing. It also contains the criminal offences and the statutory basis for ICO codes of practice.
- Key themes
- Unique features
Sets the UK age of digital consent at 13; requires an 'appropriate policy document' for many Schedule 1 processing conditions; criminal offences for re-identifying de-identified data and unlawful obtaining; since June 2026 controllers must run a data subject complaints procedure (s.164A) and acknowledge complaints within 30 days.
- SaaS relevance
Any SaaS provider within UK GDPR scope relies on DPA 2018 Schedule 1 to process health, biometric or criminal-offence data and must operate the new complaints process.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ICO within 72h (via UK GDPR Art 33); Part 3 competent authorities likewise
- DPO
- Conditional
- Cross-border transfers
- Via UK GDPR Chapter V; s.17A–17C adequacy regulations power
- Maximum penalty
- £17.5m or 4% worldwide turnover (higher maximum); unlimited fines for criminal offences
§3Dates
- Key dates
- Adopted
- In force
- Royal Assent 2018-05-23; main provisions in force 2018-05-25; amended for Brexit 2021-01-01; amended by DUAA 2025 (national security/LPP changes Sept–Nov 2025; main Part 5 changes 2026-02-05; s.164A complaints procedure 2026-06-19)
§4Text and authority
- Text
- Authoritative text legislation.gov.uk
- Authority
- Information Commissioner's Office (ICO)
§5Where it applies
- Domestic law of
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Information Commission is to replace the Information Commissioner under DUAA Part 6; one secondary source reports abolition/transfer applicable from 2026-09-30, not confirmed against a commencement SI.