UK data protection and information rights law, laid out in full
The legislation, the offences and exemptions in it, the procedures that follow from it and the guidance on applying it. Criminal, civil and regulatory consequences are kept apart, and every page links to its sources.
Which law applies where
Data protection is the same across the UK. Freedom of information and environmental information are devolved in Scotland, where Scottish public authorities answer to their own Commissioner. A UK-wide authority operating in Scotland stays under the UK Act.
All of these are amended in places by the Data (Use and Access) Act 2025, which commenced in stages. See what it changed.
Where to start
The law
Every instrument answered against the same ten questions, with its offences, exemptions, enforcement and the changes made by the DUAA 2025.
Procedures
What to do, step by step, with the deadline and the legal consequence of each failure: subject access to Scottish FOI.
Explainers
Plain answers to the first questions: what a DPIA, DPO, lawful basis, breach report or FOI request is, and when the law requires one.
Guides
Applying the law in practice, from lawful basis and DPIAs to AI, security, accountability and complaints.
Tools
Decision tools, deadline calculators, sixteen checklists, the adequacy lookup and maps of codes, regulators and overlaps.
The UK at a glance
- Principal law
- UK GDPR read with the Data Protection Act 2018
- Regulator
- Information Commission (succeeded the ICO on 2026-09-30)
- Breach notification
- Information Commission within 72 hours of awareness where there is a risk to individuals; individuals without undue delay where the risk is high. PECR providers: 72 hours since 2025-08-20.
- Maximum penalty
- Higher of £17.5m or 4% of global annual turnover (upper tier); higher of £8.7m or 2% (lower tier). PECR raised to the same levels from 2026-02-05.
- DPO required
- Public authorities and bodies; and controllers or processors whose core activities involve large-scale regular and systematic monitoring, or large-scale special category or criminal offence data (Art 37 UK GDPR).
- Digital consent age
- 13 (Art 8 UK GDPR, as set by DPA 2018 s.9)
- Extraterritorial reach
- Establishment in the UK; or, without one, offering goods or services to, or monitoring the behaviour of, individuals in the UK (Art 3 UK GDPR).
- Criminal offences
- Nine in the DPA 2018 (ss.132, 144, 148, 148C, 170, 171, 173, 184 and Sch 15 para 15), all fine-only
- Sub-national variation
- Data protection is reserved, with a few exemptions that differ by nation. Freedom of information is devolved in Scotland.
Recently in force
- Information Commissioner abolished; functions transferred to the Information Commission
- Controllers must have a process for data protection complaints
- New erasure ground for data processed because of an allegation by a "malicious person"
- Statutory meaning of research and statistical purposes, including commercial research
The full DUAA commencement tracker
EU adequacy for the UK
The EU's adequacy decisions for the UK were renewed on 2025-12-19 and run until 2031-12-27, so personal data flows from the EU and EEA to the UK without extra safeguards. Transfers in both directions