Online summaries of data protection law fail in three predictable ways. They fold criminal liability into regulatory fines, as if a penalty noticePenalty noticeThe regulator's fine. A regulatory sanction, not a criminal conviction, capped at the higher of 17.5 million pounds or 4% of global turnover. were the only consequence. They name exemptions without the conditions that trigger them. And they present contested questions as settled. Every instrument page on this site is laid out to avoid all three.
The ten structural questions
Each profile answers the same ten questions, so instruments can be compared directly:
| Question | What it asks |
|---|---|
| Territorial extent | Does it apply the same way in England, Wales, Scotland and Northern Ireland? |
| CommencementCommencementThe date a provision actually takes legal effect. Often later than Royal Assent, and different provisions of one Act frequently commence on different dates. | Is all of it in force, and from when? |
| Sunset and review | Does anything expire or have to be reviewed? |
| Criminal liabilityCriminal liabilityProsecution in the criminal courts, separate from a regulator's penalty. Different prosecutor, different standard of proof, and it can attach to an individual rather than the organisation. | Which offences, what mental element, which court, who prosecutes? |
| Civil liability | Can a person sue, and for what? |
| Enforcement toolkit | What can the regulator do, and up to what ceiling? |
| Personal liability | Can directors, officers or staff be liable themselves? |
| Sector split | Does it treat public and private bodies differently? |
| Legal persons | Does it protect companies, or only individuals? |
| Exemptions | What can be disapplied, and on what test? |
“None found” is a real answer: the point was examined and the instrument has nothing distinctive on it.
Three tracks, kept apart
The same events can lead to three different outcomes, against different defendants, in different forums:
- Regulatory. Notices and penalties from the regulator, appealable to a tribunal.
- Criminal. Prosecution of the organisation or an individual, in the criminal courts.
- Civil. A claim for compensation by the person affected, in the civil courts.
A company can receive a penalty notice while an employee is prosecuted for the same breach and a customer sues for the distress. The profiles, the offences index and the enforcement table keep the three apart for that reason.
Exemptions with their tests
An exemption that is not triggered on the facts disapplies nothing. Each exemption is recorded with its test, what it disapplies, and any territorial limit. Most are prejudice-based and apply case by case, to the extent necessary; a few are class exemptions with no test at all.
Questions answered
Each profile ends with the questions practitioners most often get wrong about that instrument, answered with the statute, case or guidance that decides them, and the sources listed below the answer.
Track changes and the tracker
Where the Data (Use and Access) Act 2025 changed an instrument, the profile shows the text before and after, with the date it took effect. The commencement tracker records each change with the regulations that brought it into force.