← Global Privacy Laws Research Library
UK GDPR + Data Protection Act 2018: United Kingdom
Prepared by Shubhank Suman · Last reviewed
CURRENT: substantially amended by DUAA 2025
- Legal character
- Combined legal framework
- Region
- Europe
What it covers
The UK's data-protection framework is composed principally of:
1. UK GDPR
2. Data Protection Act 2018
3. Privacy and Electronic Communications Regulations 2003
4. Data (Use and Access) Act 2025 amendments
The DUAA does not replace the UK GDPR or DPA 2018; it modifies them. The UK Government expressly states this. (GOV.UK)
Why it matters
The UK framework is particularly important for AI because of:
- Article 22 automated decisionmaking
- transparency
- DPIAs
- security
- profiling
- international transfers
- privacy by design
- children's data
- post-DUAA changes.
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
VERY HIGH
The framework is directly relevant to:
- automated decisions
- profiling
- AI recruitment
- AI credit decisions
- AI surveillance
- AI processing of special categories
- DPIAs
- AI training data
- transparency.
Cybersecurity
VERY HIGH
Particularly:
- Article 32
- Articles 33–34
- DPA 2018 security/enforcement provisions
- DUAA amendments.
Applicability
The UK GDPR/DPA framework applies to UK-established controllers/processors and has specified extraterritorial reach for certain third-country processing. The DUAA explanatory material confirms its data-protection amendments extend across the UK, subject to specified exceptions. (Legislation.gov.uk)
Current validity
CURRENT: AS AMENDED BY DUAA 2025.
Read first
UK GDPR Articles 5–9 → Articles 12–22 → Article 22 → Article 25 → Article 32 → Articles 33–35 → Articles 44–49 → DPA 2018 Parts 2–4 → DUAA 2025 amendments/commencement.
Provisions / sections covered
IMPORTANT UK GDPR PROVISIONS
Article 5
Core principles:
- lawfulness/fairness/transparency
- purpose limitation
- minimisation
- accuracy
- storage limitation
- integrity/confidentiality
- accountability.
Article 6
Lawful bases.
Article 9
Special-category processing.
Articles 12–22
Data-subject rights and transparency.
Article 22
Automated individual decisionmaking.
Article 25
Data protection by design/default.
Article 30
Records of processing.
Article 32
Security.
Articles 33–34
Personal-data breaches.
Article 35
DPIA.
Articles 37–39
DPOs.
Articles 44–49
International transfers.
DATA PROTECTION ACT 2018
The DPA 2018 adds national provisions and separate regimes concerning:
- law-enforcement processing
- intelligence services
- exemptions
- enforcement
- regulatory powers.
The DUAA has also amended Parts 3 and 4 of the DPA 2018 to align aspects of the law-enforcement/intelligence regimes more closely with the UK GDPR. (Legislation.gov.uk)
DUAA 2025: MAJOR CURRENT CHANGE
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025.
It changes, among other things:
Automated decisionmaking
The DUAA creates a more permissive framework for certain solely automated significant decisions but requires safeguards including:
- information about significant decisions
- representation
- challenge
- human intervention.
(GOV.UK)
Data-subject access requests
Introduces a "stop the clock" mechanism in certain circumstances and modifies search/reasonableness rules.
Children
Introduces additional requirements concerning online services likely to be accessed by children.
Scientific research
Clarifies the treatment of scientific research, including commercial research, and broadens certain consent possibilities with safeguards.
Recognised legitimate interests
Introduces a new lawful basis for specified legitimate interests.
International transfers
Modifies and clarifies aspects of international transfer rules.
Complaints
Introduces new obligations concerning data-subject complaints.
Cookies/terminal equipment
Changes the PECR storage/access regime and creates exceptions for certain lower-risk uses. (GOV.UK)
CURRENT COMMENCEMENT
This is critical.
The Government's commencement programme states that the majority of the data-protection/privacy amendments in Part 5 came into force on 5 February 2026, while some provisions have later commencement dates. Section 103/Schedule 10 concerning complaints came into force on 19 June 2026. (GOV.UK)
Therefore the PrivacyLawHub page should not display only:
"UK GDPR: Current"
It should say:
UK GDPR + DPA 2018: Current, as amended by DUAA 2025
with a commencement/version note.
FINAL STATUS TABLE: 11–30
No. Instrument 20 Sept. 2026 status AI Privacy Cyber - 11 Peru Law 29,733 Current High Very High High
12 Russia 152-FZ Current / amended High Very High Very High
13 Taiwan PDPA Current; 2025 amendments not fully commenced High Very High High
14 US Privacy Act 1974 Current Moderate Very High High
15 Virginia VCDPA Current High Very High High
16 Colorado CPA Current High Very High High
17 Indonesia PDP Law Current High Very High Very High
18 Brazil LGPD Current Very High Very High Very High
19 Switzerland FADP Current revised regime Very High Very High High
20 Turkey KVKK Current / 2024 amended High Very High Very High
21 South Africa POPIA Current / fully in force Very High Very High Very High
22 New Zealand Privacy Act Current Moderate/High Very High High
23 UAE Federal PDPL Current / in force Very High Very High Very High
24 Thailand PDPA Current / operative High Very High Very High
25 Malaysia Amendment Act 2024 Current / fully commenced High Very High Very High
26 Philippines DPA 2012 Current Very High Very High Very High
27 Nigeria NDPA 2023 Current Very High Very High Very High
28 Kenya DPA 2019 Current High Very High Very High
29 HIPAA Current High in healthcare Very High Very High
30 UK GDPR + DPA 2018 Current / amended by DUAA Very High Very High Very High
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Children's data
- Data subject rights
- Profiling
- Automated decision-making
- Impact assessment
- Data breach
- Cross-border transfers
- Data protection officer
- Controller and processor
- Privacy by design
- Cookies and tracking
- Enforcement and penalties
- Surveillance
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- UK Investigatory Powers Act 2016Law · Current (amended)Same jurisdiction; assess applicability separately.
- UK Computer Misuse Act 1990Law · Current (amended)Same jurisdiction; assess applicability separately.
- Product Security and Telecommunications Infrastructure Act 2022Law · CurrentSame jurisdiction; assess applicability separately.
- Online Safety Act 2023Law · Current (phased commencement)Same jurisdiction; assess applicability separately.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.