Data Protection Act Summary: Principles, Rights, and Duties

The Data Protection Act 2018 is the UK’s main data privacy law. It works alongside the UK General Data Protection Regulation (UK GDPR) to control how organizations collect, use, store, and share personal information, and it gives individuals enforceable rights over their own data. This Data Protection Act summary covers what the law protects, the principles organizations must follow, the rights you can exercise, and what the Information Commissioner’s Office (ICO) can do when things go wrong. The framework was updated by the Data (Use and Access) Act 2025, which brought phased changes to automated decision-making, subject access requests, and international transfers through 2025 and 2026.¹

What Counts as Personal Data

Personal data means any information that can identify a living person, directly or indirectly. A name, an ID number, location data, and online identifiers all qualify. A subset called special category data attracts stronger protection because of its sensitivity:

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic or biometric data used for identification
Health data
Data about sex life or sexual orientation

To process special category data lawfully, an organization needs one of the standard lawful bases plus a separate condition under Article 9 of the UK GDPR, such as explicit consent or a substantial public interest.²

Children’s Data

Children have extra protection. Under Article 8 of the UK GDPR, a child in the UK can give their own consent for online services from age 13. Below that age, a parent or guardian must consent on their behalf.³ The Data (Use and Access) Act 2025 added a duty on online services likely to be accessed by children to build in higher protections by design.¹

Who Has to Comply

Two roles carry the compliance burden. The data controller decides why and how personal data is processed. The data processor handles data on the controller’s behalf, typically as a service such as cloud storage or payroll. Both have legal duties, but the controller bears primary responsibility for lawful processing.⁴

The Six Lawful Bases

Before any personal data is processed, the organization must identify a lawful basis under Article 6 of the UK GDPR. No basis outranks another, but the choice matters because it affects which of your rights apply. The six bases are:

Consent. The individual has given clear, informed consent for a specific purpose. Consent must be freely given and can be withdrawn at any time.
Contract. Processing is necessary for a contract with the individual, or to take steps they have asked for before entering one.
Legal obligation. Processing is necessary to comply with a law, other than a contractual obligation.
Vital interests. Processing is necessary to protect someone’s life.
Public task. Processing is necessary for a task in the public interest or under official authority, with a clear basis in law.
Legitimate interests. Processing is necessary for the organization’s legitimate interests or those of a third party, unless the individual’s rights override them. Public authorities cannot use this basis for their official functions.

The Data (Use and Access) Act 2025 added a category of “recognised legitimate interests” for certain specified purposes. Where those apply, the organization does not have to run a detailed balancing assessment.⁵

The Seven Core Principles

Article 5 of the UK GDPR sets out seven principles. Every processing decision an organization makes should be measurable against them.⁶

Lawfulness, fairness, and transparency. Data must be processed on a valid legal basis, in a way individuals would reasonably expect, with clear information about how it is used.
Purpose limitation. Data must be collected for specific, stated purposes and not reused in ways that conflict with them.
Data minimisation. Only the data actually needed for the stated purpose should be collected. Gathering extra “just in case” falls foul of this principle.
Accuracy. Personal data must be kept accurate and current, with reasonable steps to correct or delete inaccurate records promptly.
Storage limitation. Data should not be kept longer than necessary. Retention policies and periodic reviews are the practical response.
Integrity and confidentiality. Appropriate technical and organizational security must protect data against unauthorized access, accidental loss, or destruction.
Accountability. The controller must follow the other six principles and be able to demonstrate that it has done so.

The accountability principle catches many organizations out. Following the rules is not enough on its own. You need documented proof that you followed them.

Your Rights Over Your Data

The UK GDPR grants individuals eight rights over their personal data. Some are absolute; most can be limited in specific circumstances. Organizations must generally respond to a rights request within one calendar month, with a possible extension of two further months for complex or numerous requests.

Right To Be Informed

Organizations must tell you what data they collect, why, who they share it with, and how long they keep it. This is usually done through a privacy notice written in plain language.

Right of Access

Anyone can submit a subject access request (SAR) to find out whether an organization holds their personal data, get a copy of it, and receive supplementary information about how it is being used.⁷ The response deadline is one month, extendable by up to two more months for complex or high-volume cases, but the organization must explain any delay within the first month.⁸ SARs are free in most cases. An organization can charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, such as repeated requests for the same data in different formats.⁹

Right to Rectification

You can have inaccurate or incomplete data corrected. The organization must respond within one month and either make the correction or explain why it believes the data is already accurate.

Right to Erasure

Often called the right to be forgotten, this lets you request deletion of your personal data. It applies when the data is no longer needed for its original purpose, when consent is withdrawn and no other basis applies, when the data was processed unlawfully, or when it was collected from a child in connection with an online service. The right is not absolute. Organizations can refuse where the data is needed for legal claims, to comply with a legal obligation, or for public health or archiving purposes.

Right to Restrict Processing

You can ask an organization to stop using your data while still storing it. This applies where you contest the accuracy of the data, where the processing is unlawful but you prefer restriction to deletion, where the organization no longer needs the data but you need it for a legal claim, or while an objection is being considered.

Right to Data Portability

Where processing is based on consent or a contract and is carried out by automated means, you can ask for your data in a structured, commonly used, machine-readable format such as CSV, XML, or JSON. You can also ask that it be sent directly to another controller, if that is technically feasible.¹⁰

Right to Object

You have an absolute right to object to processing for direct marketing, including profiling tied to it. No exceptions apply, and the organization must stop immediately. You can also object to processing based on public task or legitimate interests, but there the objection is not absolute: the organization can continue if it can demonstrate compelling legitimate grounds that override your interests.¹¹

Rights Around Automated Decisions

Under Article 22 of the UK GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant consequences. An automated credit refusal with no human review is a common example. If a person genuinely weighs the automated output before making the decision, the decision is not solely automated.¹² The Data (Use and Access) Act 2025 replaced the original Article 22 with new Articles 22A to 22D, broadening the lawful bases that can support automated decisions provided appropriate safeguards remain in place.¹³

What Organizations Actually Have To Do

The accountability principle translates into several concrete duties beyond simply obeying the rules.

Records of Processing

Organizations must keep detailed records covering the purposes of processing, the categories of data and data subjects, recipients, international transfers, retention periods, and a general description of security measures. Businesses with fewer than 250 employees are, in theory, exempt, but the exemption disappears if the processing involves special category data, is likely to risk individuals’ rights, or is not merely occasional. In practice, most organizations that process personal data regularly need records.

Data Protection Impact Assessments

Where processing is likely to pose a high risk to individuals, the controller must run a Data Protection Impact Assessment (DPIA) before starting. This is expected for large-scale processing of special category data, systematic monitoring of public areas, and extensive automated profiling with legal effects.¹⁴ A DPIA should be revisited as the processing evolves.

Data Protection Officers

A Data Protection Officer must be appointed when the organization is a public authority, when its core activities require regular and systematic monitoring of individuals on a large scale, or when its core activities involve large-scale processing of special category or criminal offence data. Many organizations appoint a DPO voluntarily even where it is not mandatory.

Breach Reporting

When a personal data breach occurs, the controller must report it to the ICO without undue delay and within 72 hours of becoming aware of it, unless the breach is unlikely to risk individuals’ rights and freedoms. The clock starts when the organization discovers the breach, not when the breach actually happened.¹⁵ If the breach is likely to result in a high risk to individuals, the controller must also notify the affected people directly and without undue delay. Individual notification can be avoided where the controller has applied effective protective measures such as encryption, has taken steps to eliminate the risk, or where individual notification would take disproportionate effort and a public communication is used instead.

Sending Data Abroad

Transferring personal data outside the UK needs additional safeguards. The simplest route is transferring to a country covered by UK adequacy regulations, which means the UK government has assessed that country’s protections as essentially equivalent to its own. Where adequacy applies, data can flow freely.¹⁶ Without adequacy, organizations must use appropriate safeguards, the main options being the International Data Transfer Agreement (IDTA), the International Data Transfer Addendum used with EU standard contractual clauses, or UK binding corporate rules for group transfers. A transfer risk assessment is also required. Where neither adequacy nor appropriate safeguards apply, a transfer can still proceed under narrow exceptions in Article 49, such as explicit consent or contractual necessity, but these are last resorts rather than routine mechanisms.

When the Rules Don’t Fully Apply

The UK GDPR and DPA 2018 are not absolute. Certain rights and obligations can be set aside in specific circumstances.¹⁷ Personal data processed for preventing or investigating crime, prosecuting offenders, or collecting taxes can be exempt from certain rights and transparency duties, but only to the extent that compliance would be likely to prejudice the relevant purpose. It is not a blanket override.¹⁸ Further exemptions cover journalism, academic research, art, literature, and statistical processing. Each must be assessed case by case and documented. Blanket reliance on an exemption will not satisfy the ICO. The Data (Use and Access) Act 2025 also introduced a specific exemption for legal professional privilege, so controllers cannot be required to disclose confidential lawyer-client communications in response to a SAR.¹

Enforcement and Penalties

The Information Commissioner’s Office is the independent regulator that enforces the DPA 2018 and UK GDPR.¹⁹ It can investigate complaints, run audits, issue warnings, serve enforcement notices, and impose fines. Financial penalties fall into two tiers:

Standard maximum. Up to £8.7 million or 2% of total worldwide annual turnover from the preceding financial year, whichever is higher. This tier covers infringements such as failures in record-keeping or breach notification.
Higher maximum. Up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher. This tier covers more serious violations, including breaches of the core principles or of individual rights.

When setting the final amount, the ICO weighs the nature and severity of the infringement, whether it was intentional or negligent, the number of individuals affected, and any mitigation the organization has taken.²⁰ Beyond fines, the ICO can order an organization to stop processing entirely, which for a data-dependent business can be more damaging than the money. Individuals who suffer damage from a data protection breach can also seek compensation through the courts.

1
GOV.UK. Data (Use and Access) Act Factsheet: UK GDPR and DPA
2
Information Commissioner’s Office. What Is Special Category Data?
3
Information Commissioner’s Office. What Are the Rules About an ISS and Consent?
4
Information Commissioner’s Office. What Are Controllers and Processors?
5
ICO. A Guide to Lawful Basis
6
ICO. A Guide to the Data Protection Principles
7
ICO. How Do We Recognise a Subject Access Request (SAR)?
8
Information Commissioner’s Office. What to Expect After Making a Subject Access Request
9
ICO. A Guide to Subject Access
10
ICO. Right to Data Portability
11
ICO. Right to Object
12
ICO. What Does the UK GDPR Say About Automated Decision-Making and Profiling
13
ICO. The Data Use and Access Act 2025 (DUAA) – What Does It Mean for Organisations
14
Information Commissioner’s Office. A Guide to the Data Protection Principles
15
ICO. 72 Hours – How to Respond to a Personal Data Breach
16
ICO. A Brief Guide to International Transfers
17
Information Commissioner’s Office. A Guide to the Data Protection Exemptions
18
legislation.gov.uk. Data Protection Act 2018 Schedule 2 Part 1 – Crime and Taxation: General
19
Information Commissioner’s Office. Data Protection Act 2018
20
ICO. The Maximum Amount of a Fine Under UK GDPR and DPA 2018