UK Data Protection Act 2018
The UK Data Protection Act 2018 as in force today: the Schedule 1 conditions and policy documents that make UK GDPR special category processing lawful, the full Part 3 law enforcement regime, the data protection charge, the Commissioner's notices and enforcement, the new duty to handle complaints from 19 June 2026, and the offences controllers must guard against, read from the revised text on legislation.gov.uk with every Data (Use and Access) Act 2025 change in force, and the Information Commission taking over on 30 September 2026.
UK Data Protection Act 2018 is a compliance framework from United Kingdom with 5 domains and 60 controls that map to 42 other frameworks. The largest domains are Part 3: Law enforcement processing – UK Data Protection Act 2018 (44 controls), Part 6: Enforcement, complaints and offences – UK Data Protection Act 2018 (8 controls), Part 2: General processing supplementing the UK GDPR – UK Data Protection Act 2018 (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Part 2: General processing supplementing the UK GDPR – UK Data Protection Act 2018
| Code | Title |
|---|---|
| uk-data-protection-act-2018::Sch1.Pt4 | Schedule 1 Part 4 Appropriate policy document and additional safeguards |
| uk-data-protection-act-2018::Sch2.16-17 | Schedule 2 paragraphs 16 and 17 Information about other individuals in access responses |
| uk-data-protection-act-2018::Sch3.5-6 | Schedule 3 paragraphs 5 and 6 Health data in access responses: serious harm and the appropriate health professional |
| uk-data-protection-act-2018::s.10-Sch1 | Section 10 and Schedule 1 Parts 1 to 3 Conditions for special category and criminal offence data |
| uk-data-protection-act-2018::s.13 | Section 13 Obligations of credit reference agencies |
Part 3: Law enforcement processing – UK Data Protection Act 2018
| Code | Title |
|---|---|
| uk-data-protection-act-2018::s.35 | Section 35 The first data protection principle: lawful and fair processing and sensitive processing |
| uk-data-protection-act-2018::s.36 | Section 36 The second data protection principle: purpose limitation |
| uk-data-protection-act-2018::s.37 | Section 37 The third data protection principle: adequate, relevant and not excessive |
| uk-data-protection-act-2018::s.38 | Section 38 The fourth data protection principle: accuracy and distinguishing data |
| uk-data-protection-act-2018::s.39 | Section 39 The fifth data protection principle: retention and periodic review |
| uk-data-protection-act-2018::s.40 | Section 40 The sixth data protection principle: security |
| uk-data-protection-act-2018::s.40A | Section 40A Conditions for consent to law enforcement processing |
| uk-data-protection-act-2018::s.41 | Section 41 Safeguards for archiving, research and statistical law enforcement processing |
| uk-data-protection-act-2018::s.42 | Section 42 Appropriate policy document for sensitive processing |
| uk-data-protection-act-2018::s.44 | Section 44 Information to be made available to data subjects |
| uk-data-protection-act-2018::s.45 | Section 45 Right of access by the data subject |
| uk-data-protection-act-2018::s.45A | Section 45A Legal professional privilege exemption from information and access |
| uk-data-protection-act-2018::s.46 | Section 46 Right to rectification |
| uk-data-protection-act-2018::s.47 | Section 47 Right to erasure or restriction of processing |
| uk-data-protection-act-2018::s.48 | Section 48 Rectification and erasure requests: decisions and notifications |
| uk-data-protection-act-2018::s.50B | Section 50B Restrictions on automated decision-making based on sensitive processing |
| uk-data-protection-act-2018::s.50C | Section 50C Safeguards for automated decision-making |
| uk-data-protection-act-2018::s.52 | Section 52 Form of information, identity checks and facilitating rights |
| uk-data-protection-act-2018::s.53 | Section 53 Manifestly unfounded or excessive requests |
| uk-data-protection-act-2018::s.54 | Section 54 Meaning of the applicable time period |
| uk-data-protection-act-2018::s.56 | Section 56 General obligations of the controller |
| uk-data-protection-act-2018::s.57 | Section 57 Data protection by design and default |
| uk-data-protection-act-2018::s.58 | Section 58 Joint controllers |
| uk-data-protection-act-2018::s.59 | Section 59 Processors |
| uk-data-protection-act-2018::s.60 | Section 60 Processing under the authority of the controller or processor |
| uk-data-protection-act-2018::s.61 | Section 61 Records of processing activities |
| uk-data-protection-act-2018::s.62 | Section 62 Logging |
| uk-data-protection-act-2018::s.63 | Section 63 Cooperation with the Commissioner |
| uk-data-protection-act-2018::s.64 | Section 64 Data protection impact assessment |
| uk-data-protection-act-2018::s.65 | Section 65 Prior consultation with the Commissioner |
| uk-data-protection-act-2018::s.66 | Section 66 Security of processing |
| uk-data-protection-act-2018::s.67 | Section 67 Notification of a personal data breach to the Commissioner |
| uk-data-protection-act-2018::s.68 | Section 68 Communication of a personal data breach to the data subject |
| uk-data-protection-act-2018::s.69 | Section 69 Designation of a data protection officer |
| uk-data-protection-act-2018::s.70 | Section 70 Position of the data protection officer |
| uk-data-protection-act-2018::s.71 | Section 71 Tasks of the data protection officer |
| uk-data-protection-act-2018::s.73 | Section 73 General principles for transfers of personal data |
| uk-data-protection-act-2018::s.74AA | Sections 74AA to 74B Transfers approved by regulations |
| uk-data-protection-act-2018::s.75 | Section 75 Transfers subject to appropriate safeguards |
| uk-data-protection-act-2018::s.76 | Section 76 Transfers based on special circumstances |
| uk-data-protection-act-2018::s.77 | Section 77 Additional conditions for transfers to persons other than relevant authorities |
| uk-data-protection-act-2018::s.78 | Section 78 Subsequent transfers |
| uk-data-protection-act-2018::s.80 | Section 80 Special processing restrictions on data sent abroad |
| uk-data-protection-act-2018::s.81 | Section 81 Reporting of infringements |
Part 5: The Commissioner and the data protection charge – UK Data Protection Act 2018
| Code | Title |
|---|---|
| uk-data-protection-act-2018::s.137 | Section 137 Charges payable to the Commissioner by controllers |
Part 6: Enforcement, complaints and offences – UK Data Protection Act 2018
| Code | Title |
|---|---|
| uk-data-protection-act-2018::s.142 | Sections 142 to 145 and 148 Information notices and information orders |
| uk-data-protection-act-2018::s.146 | Sections 146 to 147 Assessment notices and approved-person reports |
| uk-data-protection-act-2018::s.148A | Sections 148A to 148C Interview notices |
| uk-data-protection-act-2018::s.149 | Sections 149 to 153 Enforcement notices |
| uk-data-protection-act-2018::s.164A | Section 164A Complaints by data subjects to controllers |
| uk-data-protection-act-2018::s.170 | Section 170 Unlawful obtaining etc of personal data |
| uk-data-protection-act-2018::s.171 | Sections 171 and 172 Re-identification of de-identified personal data |
| uk-data-protection-act-2018::s.173 | Section 173 Alteration of personal data to prevent disclosure to the data subject |
Part 7: Supplementary provision – UK Data Protection Act 2018
| Code | Title |
|---|---|
| uk-data-protection-act-2018::s.184 | Section 184 and Schedule 18 Prohibition of requirement to produce relevant records |
| uk-data-protection-act-2018::s.185 | Section 185 Avoidance of contractual terms relating to health records |
Your Compliance Coverage
If you comply with UK Data Protection Act 2018, you already cover:
UK Age Appropriate Design Code (Children's Code)
6%
4 controls mapped
Compare →Virginia CDPA
4%
3 controls mapped
Compare →Uruguay DPL
4%
3 controls mapped
Compare →+ 39 more: UK GDPR (UK General Data Protection Regulation) (4%), ITU-T X.805 - Security Architecture for End-to-End Communications (4%)
See all 42 mapped frameworks ↓Maps to 42 other frameworks
Coverage is not the same as your position
This page shows what UK Data Protection Act 2018 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is UK Data Protection Act 2018 and who does it apply to?
UK Data Protection Act 2018 is a compliance framework from United Kingdom with 5 domains and 60 controls. The UK Data Protection Act 2018 as in force today: the Schedule 1 conditions and policy documents that make UK GDPR special category processing lawful, the full Part 3 law enforcement regime, the data protection charge, the Commissioner's notices and enforcement, the new duty to handle complaints from 19 June 2026, and the offences controllers must guard against, read from the revised text on legislation.gov.uk with every Data (Use and Access) Act 2025 change in force, and the Information Commission taking over on 30 September 2026. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does UK Data Protection Act 2018 actually require?
UK Data Protection Act 2018 has 60 controls organised across 5 domains. The largest domains are Part 3: Law enforcement processing – UK Data Protection Act 2018 (44 controls), Part 6: Enforcement, complaints and offences – UK Data Protection Act 2018 (8 controls), Part 2: General processing supplementing the UK GDPR – UK Data Protection Act 2018 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of UK Data Protection Act 2018 do I already cover?
UK Data Protection Act 2018 maps to 42 other compliance frameworks. The top mapping partners are UK Age Appropriate Design Code (Children's Code) (6% coverage), Virginia CDPA (4% coverage), Uruguay DPL (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement UK Data Protection Act 2018?
Start your UK Data Protection Act 2018 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about UK Data Protection Act 2018 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 60 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required