What is the Data Protection Act?
Definition
The Data Protection Act 2018 is the UK law that sets how organisations may collect, use and store personal data. It works alongside the UK GDPR and gives you rights over your own information.
- Category
- Privacy
- Also called
- Data Protection Act 2018, DPA 2018, UK Data Protection Act
- Last updated
The Data Protection Act 2018 (DPA 2018) is the UK's main data protection law. It sits next to the UK GDPR, which is the version of the EU's GDPR that was written into UK law. The ICO, the UK regulator, says organisations operating in the UK must comply with both.
The two do different jobs. The UK GDPR sets the core rules and rights. The DPA 2018 adds to them: it sets out exemptions (for example for national security, crime and taxation, and legal proceedings), covers processing by law enforcement in Part 3 and by the intelligence services in Part 4, and gives the ICO its powers.
The UK GDPR is built around seven principles, which the ICO lists as lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. In plain terms, a company should only collect what it needs, tell you what it's doing, keep it accurate and secure, and not hold it longer than necessary.
What it means for you
You can ask an organisation for a copy of the personal information it holds about you. The ICO says the organisation then has one month to deal with a request for access. You can also ask for your data to be erased in some situations, though that right isn't absolute.
If you want a company to stop listing or selling your data, this is the law behind your request.
Data Protection Act vs. related terms
- GDPR is the EU regulation. The UK GDPR is the UK copy, kept in the DPA 2018 framework.
- A data controller is the organisation that decides why and how your data is used. The Act puts duties on it.
The ICO notes some of its guidance is being updated because of the Data (Use and Access) Act, so check ico.org.uk for the current wording.
How to protect yourself
- 1
Ask what an organisation holds on you
Send a subject access request to the organisation. Say clearly that it's a request for your personal data under data protection law and keep a copy of what you sent. They have one month to respond.
- 2
Ask for deletion where you're entitled to
You can request erasure of data an organisation no longer needs. Put the request in writing and name the records you want removed.
- 3
Complain to the ICO if you're ignored
If an organisation doesn't respond properly, you can complain to the Information Commissioner's Office.
- 4
Use the law for data brokers and people-search sites
UK GDPR requests work on companies that list your details. Serus finds the sites that list you and files removal requests for you, and re-files them if your data reappears.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between the Data Protection Act and GDPR?
The UK GDPR sets the main rules and rights. The Data Protection Act 2018 adds exemptions, covers law enforcement and intelligence processing, and sets up the ICO's role. Organisations in the UK have to follow both.
How many data protection principles are there?
The UK GDPR has seven: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
Is the Personal Data Protection Act the same thing?
No. 'Personal Data Protection Act' is the name of laws in other countries, such as Singapore. The UK's law is the Data Protection Act 2018.
Does the Data Protection Act apply outside the UK?
It covers organisations operating in the UK. Elsewhere, local laws apply, such as the EU GDPR or California's CCPA.
Sources
Something wrong or out of date? Tell us and we'll re-check it.