LegalizeReform history
Data Protection Act 2018
32 versions
· 2018-05-23
2026-04-07
Data Protection Act 2018
Changes on 2026-04-07
@@ -12683,66 +12683,49 @@
##### 191
- (1) Section 54A of the Modern Slavery Act 2015 (Gangmasters and Labour Abuse Authority: information gateways) is amended as follows.
- (2) In subsection (5)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- (3) In subsection (9), after “section” insert
> —
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))
##### 192
The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.
##### 193
In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
##### 194
In section 25(1) (interpretation of this Act), at the appropriate place insert—
> “*the data protection legislation*” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
.
#### Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))
##### 192
The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.
##### 193
In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
##### 194
In section 25(1) (interpretation of this Act), at the appropriate place insert—
##### 195
In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
#### Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))
##### 196
- (1) Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as follows.
- (2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- (3) In subsection (7), at the appropriate place insert—
> “*the data protection legislation*” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
.
##### 195
In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
#### Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))
##### 196
- (1) Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as follows.
- (2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- (3) In subsection (7), at the appropriate place insert—
> “*the data protection legislation*” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
.
#### Immigration Act 2016 (c. 19)
##### 197
- (1) Section 7 of the Immigration Act 2016 (information gateways: supplementary) is amended as follows.
- (2) In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- (3) In subsection (11), at the appropriate place insert—
> “*the data protection legislation*” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Investigatory Powers Act 2016 (c. 25)
@@ -18504,8 +18487,6 @@
[^key-613cb473c0df362a19eb8619512d010f]: [S. 84(6A)](https://www.legislation.gov.uk/ukpga/2018/12/section/84/6A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-619fd5f08f26b2ca35135ceac03355dc]: [Sch. 19 para. 197](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/197) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-61adeb92f11f45e0ec84df45e73f76e0]: [Sch. 19 para. 126](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/126) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-624b7f167b9be0eda00270c5e40aba6b]: Words in s. 15(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(10)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/10/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -20320,8 +20301,6 @@
[^key-fde9fcf105d0042f1bda9820bf84606a]: [Sch. 19 para. 112](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/112) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fe184c23ee47121bd5d9ccc551211b0c]: [Sch. 19 para. 191](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/191) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fe7a3308baf800ac52f925c05dae0942]: S. 24(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(3)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/3/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fe8ced2c1696c5a472a770ed18c245f4]: S. 192 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(i)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/i)
@@ -20806,6 +20785,10 @@
[^key-0e53649fe7127715ffc24ffc24bc0ea5]: [S. 13A](https://www.legislation.gov.uk/ukpga/2018/12/section/13A) extended (S. and N.I.) (31.3.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 32(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/32/b); [S.I. 2026/317](https://www.legislation.gov.uk/uksi/2026/317), [reg. 3](https://www.legislation.gov.uk/uksi/2026/317/regulation/3)
[^key-0c2113f4e7b5a353dbe5dfefe87ffae7]: [Sch. 19 para. 191](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/191) omitted (7.4.2026) by virtue of [Employment Rights Act 2025 (c. 36)](https://www.legislation.gov.uk/ukpga/2025/36), [s. 159(3)](https://www.legislation.gov.uk/ukpga/2025/36/section/159/3), [Sch. 10 para. 90](https://www.legislation.gov.uk/ukpga/2025/36/schedule/10/paragraph/90) (with [s. 147](https://www.legislation.gov.uk/ukpga/2025/36/section/147), [Sch. 11](https://www.legislation.gov.uk/ukpga/2025/36/schedule/11)); [S.I. 2026/323](https://www.legislation.gov.uk/uksi/2026/323), [reg. 4(1)](https://www.legislation.gov.uk/uksi/2026/323/regulation/4/1)[(55)(e)](https://www.legislation.gov.uk/uksi/2026/323/regulation/4/55/e)
[^key-ce45bf3908add1b4e434190b665b2b07]: [Sch. 19 para. 197](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/197) omitted (7.4.2026) by virtue of [Employment Rights Act 2025 (c. 36)](https://www.legislation.gov.uk/ukpga/2025/36), [s. 159(3)](https://www.legislation.gov.uk/ukpga/2025/36/section/159/3), [Sch. 10 para. 90](https://www.legislation.gov.uk/ukpga/2025/36/schedule/10/paragraph/90) (with [s. 147](https://www.legislation.gov.uk/ukpga/2025/36/section/147), [Sch. 11](https://www.legislation.gov.uk/ukpga/2025/36/schedule/11)); [S.I. 2026/323](https://www.legislation.gov.uk/uksi/2026/323), [reg. 4(1)](https://www.legislation.gov.uk/uksi/2026/323/regulation/4/1)[(55)(e)](https://www.legislation.gov.uk/uksi/2026/323/regulation/4/55/e)
#### Limits on fees that may be charged by controllers
##### 17A
@@ -21322,7 +21305,7 @@
- (5) In this section, “*pre-commencement enactment*” means an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
#### Overview
#### Protection of personal data
### Relevant international law
@@ -21346,9 +21329,9 @@
- (6) In this section, “*treaty*” and “*ratified*” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).
#### Special categories of personal data etc: supplementary
#### Manual unstructured data used in longstanding historical research
#### Limits on fees that may be charged by controllers
#### National security and defence exemption
##### 42A
@@ -21704,7 +21687,7 @@
## Schedule 12A
#### Status
#### Number of members
##### 1
@@ -22761,3 +22744,7 @@
- (1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.
- (2) Regulations under this section are subject to the affirmative resolution procedure.
#### The applied GPDR
#### GDPR: right to an effective remedy against the Commissioner
2026-03-31
Data Protection Act 2018
2026-03-10
Data Protection Act 2018
2026-01-29
Data Protection Act 2018
2025-08-19
Data Protection Act 2018
2025-06-19
Data Protection Act 2018
2025-04-01
Data Protection Act 2018
2024-12-13
Data Protection Act 2018
2024-03-08
Data Protection Act 2018
2024-01-01
Data Protection Act 2018
2023-12-31
Data Protection Act 2018
2023-12-26
Data Protection Act 2018
2023-05-05
Data Protection Act 2018
2023-02-01
Data Protection Act 2018
2022-11-30
Data Protection Act 2018
2022-07-30
Data Protection Act 2018
2022-03-18
Data Protection Act 2018
2022-01-31
Data Protection Act 2018
2021-12-17
Data Protection Act 2018
2021-12-15
Data Protection Act 2018
2021-01-28
Data Protection Act 2018
2020-12-31
Data Protection Act 2018
2020-09-30
Data Protection Act 2018
2020-02-14
Data Protection Act 2018
2019-12-02
Data Protection Act 2018
2019-09-16
Data Protection Act 2018
2019-07-21
Data Protection Act 2018
2019-05-23
Data Protection Act 2018
2019-03-29
Data Protection Act 2018
2018-07-23
Data Protection Act 2018
2018-05-25
Data Protection Act 2018
2018-05-23
Data Protection Act 2018
original version
Text at this date