United KingdomUK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025
Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Consent, Disclosure, DPIA, Data subject rights, Transfer, Breach notice, Security, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish and document a lawful basis under UK General Data Protection Regulation (GDPR) Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
- Do not rely on the recognised legitimate interests basis if you are a public authority exercising your own core functions; a necessity test still applies even though no balancing test is required.
These lines are LexLint's reading of the law's text. Also read by: Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Knowingly or recklessly obtaining, disclosing, procuring the disclosure of, or (after obtaining) retaining personal data without the controller's consent is an offence under DPA 2018 s.170, as is selling or offering to sell personal data obtained in those circumstances. A separate offence under s.173 covers altering, defacing, blocking, erasing, destroying or concealing information to prevent its disclosure following a data-subject access request. Both carry an unlimited fine on summary conviction in England and Wales or on conviction on indictment, or a fine not exceeding the statutory maximum on summary conviction in Scotland or Northern Ireland (s.196), with no term of imprisonment.
Penalty structure
The Act's general ceiling: UK GDPR Art. 83(5) sets administrative fines up to the higher of £17,500,000 or 4% of worldwide annual turnover for infringement of the basic principles for processing, including conditions for consent (Arts. 5, 6, 7 and 9), matching the higher maximum amount fixed by DPA 2018 s.157(5). Narrower provisions of this Act (breach notification, Arts. 33-34) attract the lower standard maximum amount instead; see the article-scoped instrument rows in this file for those tiers.
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, the UK's single supervisory authority for data protection and PECR, exercising the Article 57 tasks and Article 58 powers conferred on it by Data Protection Act 2018 s.115.
Enforcement record
Hand count from the ICO's own enforcement action register (Type facet Monetary penalties plus Enforcement notices), read across the register's first two pages (50 of 222 total listed actions of every type), which cover back to , past the twelve-month cutoff. In the twelve months ending (the register's most recent entry), the ICO published 18 monetary penalty notices and 14 enforcement notices, for a combined 32 actions. Reprimands and prosecutions are excluded. Where the register lists a monetary penalty notice and an enforcement notice against the same underlying matter as two separate rows (for example Elderly Aids Limited, ), each row counts once as its own published enforcement instrument. Several monetary penalty rows in the register's list view state no penalty figure in the summary text shown there (only the full decision notice states it), so a sum from the visible list would understate the true total. This is the ICO's enforcement record for the data protection and PECR regime generally, not a record specific to this instrument's own provisions.
- As of
- Source link
- https://ico.org.uk/action-weve-taken/enforcement/
- Actions per year
- 32
Settledness
- As of
- Guidance link
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/recognised-legitimate-interest/
- Guidance body
- Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority
- Open questions
- Which activities of a public authority fall outside its 'public tasks or functions', so that it may rely on recognised legitimate interest for them and not on the public task basis?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 30 requires each controller and processor to keep a written record of its processing activities and to make it available to the Commission on request. The record holds purposes, categories of data and of recipients, transfers and time limits, none of which is a log field. Article 30(5) lifts the duty for an organisation of fewer than 250 persons unless its processing is risky, not occasional, or includes special category data. Other record duties sit elsewhere: Article 5(2) and Article 7(1) (a controller able to demonstrate compliance and consent), Article 33(5) (breach documentation, which has its own instrument), and section 62 of the Data Protection Act 2018 (logs of operations in law enforcement processing systems).
- Kind
- Explicit
- As of
- Provision
- UK GDPR Article 30(1), (2) and (4)
- Trigger
- personal_data_processing
Why the legislator wanted it
- As of
- Quote
- Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.
- Source link
- https://www.legislation.gov.uk/eur/2016/679/introduction
- Source kind
- Recital
- Purpose
- accountability_demonstration
- regulator_supervision
What this law does
The UK retained a copy of the General Data Protection Regulation (GDPR) at Brexit (UK GDPR) alongside the Data Protection Act 2018 (DPA 2018), but that copy has now materially diverged: the Data (Use and Access) Act 2025 (DUA Act, Royal Assent ), whose main data protection reforms took effect , added a new closed-list "recognised legitimate interests" lawful basis (Article 6(1)(ea)) needing no balancing test, whose Annex 1 conditions cover disclosure for a public-task purpose under Article 6(1)(e), national security, public security and defence, emergencies, detecting, investigating or preventing crime, and safeguarding a vulnerable individual.
Direct marketing and intra-group administrative sharing remain examples of the pre-existing Article 6(1)(f) legitimate-interests basis, not purposes of the new closed list. This basis is unavailable to a public authority exercising its own core functions, and has no equivalent in the EU GDPR Article 6 list.
How courts have read itPremium data
Our analysis of this law draws on 2 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .