ACT OF PARLIAMENT · 2018 c. 12 · TEXT IN FORCE 18 SEPTEMBER 2026

Data Protection Act 2018

An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.

18.9.2026 (legislation.gov.uk)Text in force

Prepared by Digiphile – specialist data protection lawyers.

SECTIONS BY PART

PART 1Preliminary

s. 1 s. 2 s. 3

Schedules

SCHEDULE A1Processing in reliance on relevant international law SCHEDULE 1Special categories of personal data and criminal convictions etc data SCHEDULE 2Exemptions etc from the UK GDPR SCHEDULE 3Exemptions etc from the UK GDPR: health, social work, education and child abuse data SCHEDULE 4Exemptions etc from the UK GDPR: disclosure prohibited or restricted by an enactment SCHEDULE 5Accreditation of certification providers: reviews and appeals SCHEDULE 6The applied GDPR and the applied Chapter 2 SCHEDULE 7Competent authorities SCHEDULE 8Conditions for sensitive processing under Part 3 SCHEDULE 9Conditions for processing under Part 4 SCHEDULE 10Conditions for sensitive processing under Part 4 SCHEDULE 11Other exemptions under Part 4 SCHEDULE 12The Information Commissioner SCHEDULE 12AThe Information Commission SCHEDULE 13Other general functions of the Commission SCHEDULE 14Co-operation and mutual assistance SCHEDULE 15Powers of entry and inspection SCHEDULE 16Penalties SCHEDULE 17Review of processing of personal data for the purposes of journalism SCHEDULE 18Relevant records SCHEDULE 19Minor and consequential amendments SCHEDULE 20Transitional provision etc SCHEDULE 21Further transitional provision etc