Data Protection Act 2018 Summary – What You Need to Know

Let’s start with the nuts and bolts. What exactly is the UK General Data Protection Regulation? Known as the UK GDPR, it outlines how personal information can be used by governments, businesses and organisations. It provides rules on how information relating to an identified or identifiable living person is collected, handled, processed and stored.

Whenever you log onto a website and order a product, whenever you make an electronic payment, whenever you sign up for an online newsletter, how your data is handled is governed by the UK GDPR.

The EU’s General Data Protection Regulation applied in the UK from May 2018, alongside the Data Protection Act 2018. After the Brexit transition ended in December 2020, the GDPR was retained and adapted as the UK GDPR. It continues to operate alongside the Data Protection Act 2018.

The EU GDPR replaced the Data Protection Directive, which was adopted in 1995 and implemented in the UK through the Data Protection Act 1998. That framework was designed before today’s digital services became commonplace.

The Data Protection Directive was a directive, not a directly applicable regulation under EU law. It meant that each country implemented its requirements through national rules. Differences between those rules could complicate data sharing across borders, although the directive already required protections for accuracy and security. In 2016, the EU adopted the GDPR to create a more consistent framework.

In 1998, Facebook, TikTok, Instagram and modern smartphones had not yet become part of daily life. The World Wide Web was awkward and slow, and we needed noisy dial-up modems to access it. The digital world was a very different place. In the UK, the Data Protection Act 2018 replaced the Data Protection Act 1998, which was also no longer fit for purpose.

Technology has evolved considerably since then. The UK GDPR and Data Protection Act 2018 now provide the main framework for using personal information responsibly and keeping it safe.

The UK GDPR, supplemented by the Data Protection Act 2018, protects personal information relating to an identified or identifiable living person. This includes names, contact details and customer records. Some personal information needs extra protection. These special categories include data about your:

• Race
• Ethnic background
• Political opinions
• Religious beliefs
• Trade union membership
• Genetics
• Biometrics (where used for identification)
• Health
• Sex life or sexual orientation

The UK GDPR’s strict rules are based on well-defined data protection principles. Under the GDPR, personal information must be:

• Used fairly in a lawful and transparent manner
• Used only for explicitly stated specific purposes
• Used in the most relevant and minimal way required to accomplish a specific purpose
• Correct and up-to-date
• Kept for no longer than necessary
• Handled to ensure security
• Handled responsibly, with organisations able to demonstrate compliance

You have rights under the UK GDPR, subject to conditions and exemptions. Similar rights exist under the EU GDPR. These include:

• The right to be informed of how your data is used
• The right to access your data
• The right to rectify incorrect data
• The right to erase data
• The right to restrict the processing of your data
• The right to transfer your data
• The right to object to how your data is being used
• Rights related to significant decisions made solely by automated means, including profiling

The Data (Use and Access) Act 2025 amended, but did not replace, the UK GDPR and Data Protection Act 2018. Since June 2026, organisations must also provide a way for people to make data protection complaints, acknowledge complaints within 30 days and respond without undue delay.

While these rights and data protection principles are similar in both the UK GDPR and the EU GDPR, there are some differences.

The two regimes remain closely aligned, but some rules and local requirements differ:

1. The Age of Consent: In the UK, a child aged 13 or over may consent to the use of their data when an online service relies on consent. EU countries set this age between 13 and 16.
2. How Criminal Data is Processed: Both regimes impose extra conditions. In the UK, processing requires official authority or a condition under the Data Protection Act 2018. In the EU, it must be under official authority or authorised by EU or member state law.
3. Automated Decision-Making: Since February 2026, the UK GDPR has allowed significant decisions made solely by automated means on a wider range of lawful bases, subject to safeguards. The EU GDPR retains more restrictive rules for such decisions.
4. Research and Archiving: Both regimes provide qualified exemptions for research, statistics and archiving. The conditions vary, and the UK’s 2025 reforms clarified some research provisions.
5. Privacy and Freedom of Expression: Both regimes make provision for freedom of expression, including journalism, but exemptions apply only in specified circumstances.
6. GDPR Representatives: Organisations based outside the UK or EEA may need a representative there if they offer goods or services to people in that area or monitor their behaviour. Exceptions apply; appointment is not automatic.
7. GDPR Penalty Maximums: For the most serious infringements, the EU GDPR’s higher maximum is €20 million or 4% of annual worldwide turnover, whichever is higher. The UK GDPR’s higher maximum is £17.5 million or 4%, whichever is higher.

Since Brexit, the rules around data protection in the EU and the UK have gotten a little more complicated. If your business operates in the EEA, offers goods or services to people there, or monitors their behaviour, the EU GDPR may also apply. Depending on your circumstances, you may need to:

• Appoint a representative in the EEA if required
• Identify the relevant EEA supervisory authorities
• Review data transfers and contracts where additional safeguards are needed
• Update policies, procedures and documentation to reflect the rules that apply

The EU renewed its adequacy decision for the UK in December 2025. This allows covered personal information to flow from the EEA to the UK without additional transfer safeguards.

If your business operates only in the UK and does not offer goods or services to people in the EEA or monitor their behaviour, the UK GDPR and Data Protection Act 2018 will generally be the main data protection rules to consider.

If you’re still a little wary of whether your business is compliant with the UK GDPR or the EU GDPR, that’s probably a good thing. These laws apply to businesses of all sizes and also to self-employed individuals. It makes good sense to be sure that you’re doing everything you can to abide by them.

Taking our GDPR Training can help staff understand their data protection responsibilities.

This training covers the fundamentals of UK data protection law and practical ways to handle personal information safely. The course covers the roles and responsibilities of both employers and employees.

You can complete the course online in segments whenever you like. The course is CPD-certified and provides a certificate on completion. Awareness training alone cannot establish or prove that a business complies with data protection law; organisations also need suitable policies, procedures and safeguards.