[revise] The Data Protection Act 2018 (UK DPA)

The Data Protection Act 2018 (UK DPA) is the domestic implementation of the EU GDPR (now UK GDPR), and it provides some data protection rules for sectors where the EU GDPR does not apply.

For example, the EU GDPR does not apply in the national security field. In order to define how national security authorities deal with personal data, their powers and limits, the UK DPA provides a regulation. The UK DPA also sets the enforcement powers of the Information Commissioner’s Officer (ICO), the Data Protection Authority in the UK.

These are the sections of the DPA 2018:

• General rules on processing
• The GDPR
• Law enforcement processing
• Intelligence services processing
• Transfers of personal data outside the United Kingdom
• Exemptions
• The Information Commissioner
• Enforcement
• Supplementary and final provision