UK Data Protection Act 2018
Amended United Kingdom · In force May 25, 2018 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.
- Who it applies to
- Controllers and processors processing personal data in the UK or of people in the UK, plus law enforcement and intelligence processing.
- Penalties
- Fines up to GBP 17.5 million or 4% of worldwide annual turnover for the most serious UK GDPR infringements; criminal offences for certain conduct.
- Enforced by
- Information Commissioner (Information Commission from 2026)
- Official name
- Data Protection Act 2018
- Citation
- 2018 c. 12
- Topics
- privacy, breach-notification, children
Verified 2026-09-25 legislation.gov.uk
Research notes
Tracked separately from uk-gdpr and uk-duaa. Fine maximums come from the UK GDPR as read with section 157; check before display.
Related
Questions about UK Data Protection Act 2018
- What are the UK Data Protection Act 2018 compliance deadlines?
- May 23, 2018: Royal Assent. May 25, 2018: Main provisions commence. Jul 23, 2018: Age appropriate design code powers commence.
- When does UK Data Protection Act 2018 take effect?
- UK Data Protection Act 2018 took effect on May 25, 2018.
- Who does UK Data Protection Act 2018 apply to?
- Controllers and processors processing personal data in the UK or of people in the UK, plus law enforcement and intelligence processing.
- What are the penalties under UK Data Protection Act 2018?
- Fines up to GBP 17.5 million or 4% of worldwide annual turnover for the most serious UK GDPR infringements; criminal offences for certain conduct.