41 working definitions for orientation. Where a term is defined in law, the entry names the provision, and the statutory definition governs: it is often narrower than the everyday sense of the word.
Regulations by the Secretary of State allowing transfers to a country without further safeguards, often called data bridges. Since the DUAA the test is whether protection there is not materially lower than in the UK.
Defined in UK GDPR Art 45, as amended by DUAA 2025
Regulator-approved internal rules letting a multinational group transfer personal data within the group.
Defined in UK GDPR Art 47
Explainer: What is a restricted transfer, and what do you need to make one?
The duty to tell the regulator about a personal data breach within 72 hours where there is a risk to people, and to tell the people affected where the risk is high.
Defined in UK GDPR Arts 33 and 34; PECR reg 5A for communications providers
Explainer: What is a personal data breach, and when must you report it?
The date a provision actually takes legal effect. Often later than Royal Assent, and different provisions of one Act frequently commence on different dates.
Decides why and how personal data is processed. Carries most of the duties, and most of the penalties.
Defined in UK GDPR Art 4(7); DPA 2018 s.6
Explainer: Are you a controller or a processor?
Prosecution in the criminal courts, separate from a regulator's penalty. Different prosecutor, different standard of proof, and it can attach to an individual rather than the organisation.
A protected adviser who monitors compliance and is the contact point for the regulator. Mandatory for public authorities and some large-scale processing.
Defined in UK GDPR Arts 37 to 39
Explainer: What is a data protection officer, and when must you appoint one?
The DUAA test for international transfers: whether protection in the destination is not materially lower than in the UK. A different wording from the EU's essentially equivalent standard.
Defined in UK GDPR Chapter V, as amended by DUAA 2025 s.85 and Sch 7
Explainer: What is a restricted transfer, and what do you need to make one?
The test that separates a controller from a processor: who decides why the processing happens. Not who holds the data, who is larger, or what the contract calls them.
Explainer: Are you a controller or a processor?
A subject a devolved legislature can make law on. Freedom of information is devolved in Scotland, so Scotland has its own FOI Act and Commissioner.
Explainer: Does FOIA or FOISA apply to a Scottish body?
Data protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people.
Defined in UK GDPR Art 35
Explainer: What is a DPIA, and when do you need one?
An order to take, or stop taking, specified steps. It has no figure attached but can be more disruptive than a fine.
Defined in DPA 2018 s.149
Information about the state of the environment and things affecting it. Requests for it go through the environmental information regulations, not the FOI Acts.
Defined in EIR 2004 reg 2; EIRS 2004 reg 2
Explainer: What is environmental information, and when do the EIR apply instead of FOI?
The International Data Transfer Agreement: the UK's own contract for restricted transfers where no adequacy regulations apply.
Defined in DPA 2018 s.119A; UK GDPR Art 46
Explainer: What is a restricted transfer, and what do you need to make one?
The UK data protection and FOI regulator. A board-led body that succeeded the Information Commissioner (the ICO) on 2026-09-30, with the same role and powers.
Defined in DPA 2018 Part 5, as amended by DUAA 2025
A lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights.
Defined in UK GDPR Art 6(1)(f)
Explainer: What is a lawful basis, and which one do you need?
A specific rule that prevails over a general one on the same subject. PECR is lex specialis to the UK GDPR for electronic marketing and cookies.
Explainer: What is PECR, and does it apply to you?
The mental element an offence requires, such as intention, knowledge or recklessness. Most DPA 2018 offences need knowledge or recklessness.
Defined in General criminal law
Whether the purpose could reasonably be achieved by a less intrusive route. Not whether the processing is useful, cheaper or standard practice.
Explainer: What is a lawful basis, and which one do you need?
The regulator's provisional penalty, issued before a final penalty notice so the organisation can make representations. Final figures are often much lower.
Defined in DPA 2018 Sch 16
The EU mechanism routing cross-border cases through a lead authority. The UK left it at the end of the transition period, so UK and EU cases now run separately.
Converting retained EU law into domestic law after Brexit, with amendments so it works outside the EU framework. The UK GDPR is the onshored GDPR.
The regulator's fine. A regulatory sanction, not a criminal conviction, capped at the higher of 17.5 million pounds or 4% of global turnover.
Defined in DPA 2018 s.155
Any information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out.
Defined in UK GDPR Art 4(1); DPA 2018 s.3(2)
Explainer: What is personal data?
A conditional exemption that applies only to the extent that complying would be likely to harm a stated purpose. Assessed case by case, never a blanket carve-out.
Explainer: What is the public interest test in FOI?
Processes personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties.
Defined in UK GDPR Art 4(8)
Explainer: Are you a controller or a processor?
Automated processing to evaluate personal aspects of someone, such as performance, finances, health or behaviour. Automated decisions are now governed by UK GDPR Arts 22A to 22D.
Defined in UK GDPR Art 4(4)
Explainer: What are the rules on automated decision-making and profiling?
Replacing identifiers so data cannot be attributed to a person without separately held information. Pseudonymised data is still personal data, unlike truly anonymous data.
Defined in UK GDPR Art 4(5)
Explainer: What is personal data?
In FOI law, the test applied to qualified exemptions: information is withheld only if the public interest in withholding it outweighs the public interest in disclosure.
Defined in FOIA 2000 s.2; FOISA 2002 s.2
Explainer: What is the public interest test in FOI?
The DUAA limit on subject access: a person is entitled only to what the controller can provide based on such a search. In force from Royal Assent and treated as in force from 2024-01-01.
Defined in UK GDPR Art 15(1A), inserted by DUAA 2025 s.78
Explainer: What is a subject access request, and how long do you have?
The numbered explanatory paragraphs before the GDPR's articles. Not binding in themselves, but used to interpret the articles.
A UK-only lawful basis for listed purposes, such as national security, emergencies, crime prevention and safeguarding, where no balancing test is needed. In force from 2026-02-05.
Defined in UK GDPR Art 6 and Annex 1, inserted by DUAA 2025 s.70 and Sch 4
Explainer: What is a lawful basis, and which one do you need?
An offence that is entered on police records on conviction, so it shows up in criminal record checks even if the sentence was only a fine.
Action by the regulator, such as notices, audits and penalties. Runs separately from any prosecution over the same facts.
Sent back to a lower court or tribunal to decide again, applying corrected reasoning. The appeal body does not substitute its own decision.
A formal finding that an organisation infringed the law, without a fine. Commonly used for public sector bodies.
A subject kept by the UK Parliament rather than devolved. Data protection is reserved, which is why the UK has one data protection regime.
Health, genetic and biometric data, racial or ethnic origin, political opinions, beliefs, trade union membership, sex life and sexual orientation. Processing needs an Art 9 condition as well as a lawful basis.
Defined in UK GDPR Art 9(1); DPA 2018 ss.10 and 11, Sch 1
Explainer: What is special category data, and what extra do you need to use it?
The pause in a response deadline while a controller reasonably waits for identity evidence or clarification. Codified by the DUAA for requests received from 2026-02-05.
Defined in DUAA 2025 s.76
Explainer: What is a subject access request, and how long do you have?
Practitioner shorthand for exercising the right of access. Not a statutory phrase, and no particular form or wording is required to make one.
Defined in UK GDPR Art 15; DPA 2018 s.45 (law enforcement) and s.94 (intelligence services)
Explainer: What is a subject access request, and how long do you have?
An addendum that adapts the EU standard contractual clauses for UK transfers, so a group can use one set of clauses for both.
Defined in DPA 2018 s.119A; UK GDPR Art 46
Explainer: What is a restricted transfer, and what do you need to make one?