Data Governance Atlas UK edition

The law

The 8 UK instruments in scope, grouped by regime. Every profile answers the same ten structural questions, lists criminal offences separately from regulatory penalties, and records every exemption with the test that triggers it.

Data protection

  • Data (Use and Access) Act 2025

    Partially in force

    Data (Use and Access) Act 2025, c. 18. UK-wide. no offences, 3 exemptions.

    The largest change to UK data protection law since 2018, and also a wider data Act.

  • Data Protection Act 2018

    In force

    Data Protection Act 2018, c. 12. UK-wide. 9 offences, 41 exemptions.

    The UK's domestic data protection statute.

  • UK GDPR

    In force

    Regulation (EU) 2016/679 as retained and amended by the European Union (Withdrawal) Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419). UK-wide. no offences, 1 exemption.

    The UK GDPR is the EU General Data Protection Regulation (Regulation (EU) 2016/679) as it was retained in UK domestic law at the end of the Brexit transition period and then textually amended ("onshored") by the 2019 EU Exit Regulations.

Electronic communications

Freedom of information

  • Freedom of Information (Scotland) Act 2002

    In force

    Freedom of Information (Scotland) Act 2002, asp 13. Scotland. 1 offence, 20 exemptions.

    An Act of the Scottish Parliament giving any person a right of access to information held by Scottish public authorities, regulated by the Scottish Information Commissioner.

  • Freedom of Information Act 2000

    In force

    Freedom of Information Act 2000, c. 36. England and Wales, Northern Ireland. 1 offence, 27 exemptions.

    The general right of access to recorded information held by public authorities in England, Wales and Northern Ireland, and by UK-wide public authorities, including their work in Scotland.

Environmental information

  • Environmental Information (Scotland) Regulations 2004

    In force

    SSI 2004/520. Scotland. 1 offence, 13 exemptions.

    A separate right of access to environmental information held by Scottish public authorities, implementing the Aarhus Convention through Directive 2003/4/EC.

  • Environmental Information Regulations 2004

    In force

    SI 2004/3391. England and Wales, Northern Ireland. 1 offence, 13 exemptions.

    A separate right of access to environmental information held by public authorities in England, Wales and Northern Ireland and UK-wide public authorities, implementing the Aarhus Convention through Directive 2003/4/EC.

Cross-referenced statutes

These appear through the interactions recorded on the profiles above, where they meet the eight instruments.