UK Data Protection Act 2018
The UK Data Protection Act 2018 supplements the UK GDPR (retained EU law) and implements the Law Enforcement Directive provisions. It sets out the framework for data protection in the UK including the role and powers of the Information Commissioner's Office (ICO), processing conditions for law enforcement and intelligence services, and UK-specific derogations. Applies alongside the UK GDPR to all processing of personal data.
UK Data Protection Act 2018 is a compliance framework from United Kingdom with 7 domains and 12 controls that map to 46 other frameworks. The largest domains are General Processing (Part 2) (4 controls), Law Enforcement Processing (Part 3) (3 controls), ICO (1 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
General Processing (Part 2)
| Code | Title |
|---|---|
| UK-DPA18-GEN-01 | Lawful Bases and Conditions |
| UK-DPA18-GEN-02 | ICO Powers and Enforcement |
| UK-DPA18-GEN-03 | Age of Consent for ISS |
| UK-DPA18-GEN-04 | UK-Specific Exemptions |
ICO
| Code | Title |
|---|---|
| UKDPA-4 | ICO Powers and Enforcement |
Law Enforcement Processing (Part 3)
| Code | Title |
|---|---|
| UK-DPA18-LE-01 | Law Enforcement Processing Principles |
| UK-DPA18-LE-02 | Data Subject Rights (Law Enforcement) |
| UK-DPA18-LE-03 | International Transfers (Law Enforcement) |
Part 3 Law Enforcement
| Code | Title |
|---|---|
| UKDPA-2 | Law Enforcement Processing (Part 3) |
Part 4 Intelligence
| Code | Title |
|---|---|
| UKDPA-3 | Intelligence Services Processing (Part 4) |
Scope
| Code | Title |
|---|---|
| UKDPA-1 | Scope, UK GDPR Implementation, Parts 1-2 |
Specific Topics
| Code | Title |
|---|---|
| UKDPA-5 | Children, Automated Decisions, Breach, International Transfers |
Your Compliance Coverage
If you comply with UK Data Protection Act 2018, you already cover:
UK Age Appropriate Design Code (Children's Code)
33%
4 controls mapped
Compare →Virginia CDPA
25%
3 controls mapped
Compare →Uruguay DPL
25%
3 controls mapped
Compare →+ 43 more: UK GDPR (UK General Data Protection Regulation) (25%), ITU-T X.805 - Security Architecture for End-to-End Communications (25%)
See all 46 mapped frameworks ↓Maps to 46 other frameworks
What is UK Data Protection Act 2018 and who does it apply to?
UK Data Protection Act 2018 is a compliance framework from United Kingdom with 7 domains and 12 controls. The UK Data Protection Act 2018 supplements the UK GDPR (retained EU law) and implements the Law Enforcement Directive provisions. It sets out the framework for data protection in the UK including the role and powers of the Information Commissioner's Office (ICO), processing conditions for law enforcement and intelligence services, and UK-specific derogations. Applies alongside the UK GDPR to all processing of personal data. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does UK Data Protection Act 2018 actually require?
UK Data Protection Act 2018 has 12 controls organised across 7 domains. The largest domains are General Processing (Part 2) (4 controls), Law Enforcement Processing (Part 3) (3 controls), ICO (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of UK Data Protection Act 2018 do I already cover?
UK Data Protection Act 2018 maps to 46 other compliance frameworks. The top mapping partners are UK Age Appropriate Design Code (Children's Code) (33% coverage), Virginia CDPA (25% coverage), Uruguay DPL (25% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement UK Data Protection Act 2018?
Start your UK Data Protection Act 2018 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about UK Data Protection Act 2018 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 12 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required