The UK's domestic data protection statute. It supplies the UK-specific detail the GDPR leaves to member state law, transposes the Law Enforcement Directive in Part 3, and covers processing outside the UK GDPR's scope (intelligence services, Part 4). It is read with the UK GDPR as a single regime rather than as a standalone code. Its most-missed layer is criminal: nine distinct offences, all fine-only, sitting entirely separately from the regulator's penalties.
Commenced essentially in full alongside the GDPR on 2018-05-25 and amended in place since. The amending Data (Use and Access) Act 2025 commenced in stages: the main data protection tranche from 2026-02-05 (SI 2026/82), the complaints duty from 2026-06-19 (SI 2026/82 reg 3), and the Information Commission from 2026-09-30 (SI 2026/1015). See the commencement tracker for each change.
Inseparable. The two are read as a single regime via a Keeling-schedule-style construction: the Act is not self-contained and cannot be interpreted alone.
What the Data (Use and Access) Act 2025 changed here, before and after, with the date each took effect. All tracked changes
No statutory duty on controllers to handle complaints. A complaint went straight to the regulator.
Controllers must make complaints easy to lodge, acknowledge them within 30 days and respond without undue delay. The regulator comes second.
Effect summary in the site's own words, not statutory text.
A data subject may make a complaint to the controller.
The Information Commissioner, a corporation sole.
The Information Commission, a body corporate led by a board, with the same role and powers.
Effect summary in the site's own words, not statutory text.
Information notices, assessment notices, enforcement notices and penalty notices.
Information notices, assessment notices, interview notices, a power to require a report, enforcement notices and penalty notices.
Effect summary in the site's own words, not statutory text.
Ten questions every profile answers explicitly. "None found" means the point was examined and the instrument has nothing distinctive on it.
| # | Point | Finding | Notes |
|---|---|---|---|
| 1 | Territorial extent | Asymmetry found | Extends to the whole UK. The territorial differences sit inside the exemptions: the child abuse data exemption (Sch 3 para 21) applies in England, Wales and Northern Ireland but cannot apply in Scotland; the Principal Reporter restrictions (Sch 3 paras 12 and 20) and the children's hearings exemption (Sch 4 para 6) apply only in Scotland; and the age at which a parent can make a request for a child differs (under 18, or under 16 in Scotland). These are narrow, not a devolved regime: data protection is a reserved matter under the Scotland Act 1998 and its equivalents. |
| 2 | Commencement | Asymmetry found | The Act itself commenced essentially in full on 2018-05-25 (s.198, for instance, is in force from that date). The amended text is phased: DUAA 2025 changes commenced on different dates between Royal Assent (2025-06-19) and 2026-09-30, so the text in force on a given date depends on which tranche had commenced. The commencement tracker records each change with the regulations that commenced it. |
| 3 | Sunset / mandatory review | None found | The Act carries no built-in expiry or mandatory review. The EU's adequacy decisions for the UK, which sit outside the Act, do carry a sunset (renewed 2025-12-19, running to 2031-12-27, with a review at the four-year mark), so they act as an external review point on UK divergence. |
| 4 | Criminal liability | Asymmetry found | A distinct criminal track exists, separate from regulatory fines: ss.132, 144, 148, 148C, 170, 171, 173 and 184 and Sch 15 para 15. All are fine-only and no imprisonment is available for any of them. Most are either way with an unlimited fine; s.173 and the warrant offence are summary only, capped at level 5 in Scotland and Northern Ireland (s.196). The practical consequence is an escalation asymmetry: high-harm conduct a prosecutor thinks merits custody is charged instead under the Fraud Act 2006 or the Computer Misuse Act 1990. |
| 5 | Civil liability | None found | Compensation runs through Article 82 UK GDPR read with s.168 DPA 2018, covering material and non-material damage, in the County Court or High Court (sheriff court or Court of Session in Scotland). There is no general private right of action of the California type. |
| 6 | Regulatory enforcement toolkit | None found | Uniformly available UK-wide: information notice, assessment notice, enforcement notice and penalty notice (s.155), the last capped at the higher of £17.5m or 4% of global annual turnover, with a lower tier (£8.7m or 2%) for less serious infringements. The DUAA added interview notices (s.100) and a power to require a report (s.98), both in force from 2026-02-05. Since 2026-09-30 these powers sit with the Information Commission rather than the Information Commissioner. |
| 7 | Personal / director liability | Asymmetry found | Section 198 makes a director, manager, secretary or similar officer personally guilty alongside the body corporate where an offence is committed with their consent or connivance, or is attributable to their neglect. s.198(3) extends the same logic to partnerships and unincorporated membership bodies. This is criminal only: there is no civil equivalent making directors personally liable for Art 82 compensation claims in the ordinary case. |
| 8 | Public vs private sector split | Asymmetry found | No public/private split in the statute (contrast Mexico, Switzerland), but the Parts diverge internally by purpose: Part 2 (general processing under the UK GDPR), Part 3 (law enforcement, transposing the LED) and Part 4 (intelligence services, overseen partly by IPCO rather than solely the Information Commission). A single controller can be a Part 2 body for most of its processing and a Part 3 or 4 body for a slice of it. |
| 9 | Legal-person coverage | None found | Natural persons only, consistent with the GDPR. No extension to companies or other legal persons (contrast POPIA and the old Swiss FADP). |
| 10 | Exemptions, with their conditions | Asymmetry found | Section 26 and Schedules 2, 3 and 4 disapply specific rights subject to specific tests, not as blanket carve-outs. Triggers differ materially: a prejudice test for crime and taxation and most regulatory functions, a "prevent or seriously impair" test for research and archiving, a reasonable-belief test for journalism, a serious harm test for health, social work and education data, statutory safeguards written into the Act for immigration (since 2024), and pure class exemptions with no test for legal privilege and confidential references. All 41 are recorded below with their triggers. |
A distinct track, separate from the regulatory penalties below. The same failure can attract both: a penalty notice against the organisation and a prosecution of the individual.
Criminalises current or former staff of the regulator (the Information Commission since 2026-09-30, previously the Commissioner), and those acting on the regulator's behalf, who unlawfully disclose information obtained in the course of their duties. Replaces DPA 1998 s.59.
Making a statement in response to an information notice that the person knows to be false in a material respect, or recklessly making a statement that is false in a material respect.
Where an information notice or assessment notice has been given, destroying, disposing of, concealing, blocking or falsifying information, a document, equipment or material, with the intention of preventing the regulator from viewing or being provided with it.
Making a statement in response to an interview notice that the person knows to be false in a material respect, or recklessly making a statement that is false in a material respect. Inserted by the DUAA 2025 s.100 and in force from 2026-02-05.
Obtaining or disclosing personal data without the controller's consent; procuring its disclosure to another person without consent; or retaining personal data after obtaining it without the consent of the person who was the controller at the time: the extension over the old DPA 1998 s.55 offence. Selling, or offering to sell, data knowingly or recklessly obtained or disclosed this way is also caught. Historically the most-charged data offence, commonly used against people who accessed healthcare or financial records out of curiosity or for gain.
Defences
Re-identifying information that has been de-identified (for example by redaction) without the consent of the controller who de-identified it. Introduced on the recommendation of the National Data Guardian for Health and Care.
Defences
A controller, or someone employed by, an officer of, or otherwise directed by the controller, who alters, defaces, blocks, erases, destroys or conceals information intending to prevent its disclosure to someone who had made a subject access request and would have been entitled to receive it. Builds on an equivalent FOIA 2000 offence.
Defences
Requiring another person to exercise their own subject access right and supply the resulting records as a condition of employment, of a contract, or of the provision of goods, facilities or services to the public: the "let us see your DSAR results before we'll hire, insure or serve you" scenario. Builds on DPA 1998 s.56; the "relevant records" concept is defined in Schedule 18.
Intentionally obstructing a person executing a warrant of entry and inspection issued under Schedule 15, failing without reasonable excuse to give them the assistance they reasonably require, or making a statement in response to their requirements that is false in a material respect, knowingly or recklessly.
Compensation is available for material and non-material damage. Non-material damage (distress, loss of control over one's data) is expressly compensable: a genuine expansion over the pre-GDPR position, where UK courts were initially reluctant to award damages for distress alone. There is no general private right of action of the California type: individuals rely on Art 82/s.168 for money and on the regulator's toolkit for orders requiring compliance.
County Court or High Court (sheriff court or Court of Session in Scotland); Material and non-material damage : Claim lies against the controller or the processor.
County Court or High Court : The court may order a controller or processor to take specified steps to comply, alongside or instead of ordering compensation.
Requires the recipient to provide specified information within a set period.
Permits the regulator to assess whether a controller or processor is complying, an audit power.
Requires specified steps to bring processing into compliance, or stops specified processing altogether.
The financial penalty, at the ceiling above.
Requires a person to attend and answer questions (s.148A), subject to restrictions (s.148B); a knowingly or recklessly false statement in response is an offence (s.148C). In force from 2026-02-05 (SI 2026/82).
These sit entirely separately from the criminal offences. A company can face a s.155 penalty notice for the underlying data protection failure and, independently, an employee can be prosecuted under s.170 for what they personally did with the data.
Where an offence is committed by a body corporate with the consent or connivance of, or attributable to neglect on the part of, a director, manager, secretary or similar officer (or someone purporting to act as one), that individual is personally guilty alongside the body corporate and liable to be proceeded against and punished accordingly. Offences under ss.170, 171 and 173 are recordable, so a conviction leaves a criminal record.
Protection runs to identified or identifiable natural persons only, consistent with the GDPR. Contrast POPIA and the old Swiss FADP, which covered legal persons.
One statute for public and private sectors alike. The real internal asymmetry is not public/private but which Part governs which purpose: a police force is a Part 3 body for its investigations and a Part 2 body for its HR data.
General processing under the UK GDPR, public and private sector alike.
Competent authorities processing for law enforcement purposes (transposing the Law Enforcement Directive), with its own principles and rights, distinct from Part 2.
Intelligence services processing, with its own distinct regime and oversight via the Investigatory Powers Commissioner, not solely the Information Commission.
Recorded with their trigger conditions, not as bare names, most are conditional tests applied case by case rather than blanket carve-outs.
Trigger
Applies where exemption from a provision is required for the purpose of safeguarding national security or for defence purposes. A Minister of the Crown can certify that exemption is required for national security; the certificate is conclusive evidence of that, subject to challenge before the Upper Tribunal on judicial review principles (s.27).
Disapplies
Narrow in practice: "required" is a higher bar than "likely to prejudice". The DUAA 2025 (s.88) added an equivalent national security exemption for law enforcement processing under Part 3.
Trigger
Applies only to the extent that applying the provisions would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. A prejudice test applied case by case, not an automatic exemption for anyone processing crime-adjacent data. A second controller that receives the data for its statutory functions can rely on it on the same test.
Disapplies
Trigger
A classification applied to a data subject under a risk assessment system operated by a government department, local authority or housing benefit authority for crime or tax purposes, to the extent that applying the provisions would prevent the system operating effectively.
Disapplies
Trigger
Applies where applying the provisions would be likely to prejudice the maintenance of effective immigration control, or the investigation or detection of activities that would undermine it. Since 2024-03-08 the safeguards are in the Act itself (paras 4A and 4B): each decision is made case by case, separately for each right and afresh each time; the Secretary of State must weigh the person's vulnerability, their rights including Convention rights, and the UK's international and child welfare obligations; the exemption applies only where there is a substantial risk of prejudice that outweighs the harm to the person and is necessary and proportionate; and each use must be recorded with reasons and, unless that would itself prejudice immigration control, the person told.
Disapplies
The most litigated exemption in the Act. The Court of Appeal held the original version unlawful in 2021 for lacking safeguards, and held the 2022 policy-document fix unlawful in 2023 because the safeguards had to be in legislation. The 2024 Regulations moved them into the Act.
Trigger
Applies where disclosure is required by an enactment, a rule of law or a court or tribunal order, or is necessary for legal proceedings (including prospective proceedings), obtaining legal advice, or establishing, exercising or defending legal rights, to the extent that applying the provisions would prevent the controller making the disclosure.
Disapplies
Trigger
Processing for functions listed in the Schedule's table, such as protecting the public against financial loss from dishonesty or malpractice, protecting charities, securing health and safety at work, and protecting the public against maladministration, where the function is conferred by enactment, is a Crown, ministerial or government department function, or is of a public nature exercised in the public interest. Applies to the extent that applying the provisions would be likely to prejudice the proper discharge of the function.
Disapplies
Trigger
Functions conferred by enactment on the Comptroller and Auditor General, the Auditor General for Scotland, the Auditor General for Wales or the Comptroller and Auditor General for Northern Ireland, to the extent that applying the provisions would be likely to prejudice the proper discharge of the function.
Disapplies
Trigger
The Bank's functions as a monetary authority, its functions of a public nature, and its functions as the Prudential Regulation Authority, to the extent that applying the provisions would be likely to prejudice their proper discharge.
Disapplies
Trigger
Listed functions of bodies such as the Legal Services Board, the bodies handling complaints about legal services, the health service complaints and ombudsman bodies, and the children's commissioners, to the extent that applying the provisions would be likely to prejudice their proper discharge.
Disapplies
Trigger
Functions of the regulators and ombudsmen listed in the Schedule's table, conferred by the enactments listed there, to the extent that applying the provisions would be likely to prejudice their proper discharge.
Disapplies
Trigger
Applies where exemption is required to avoid an infringement of the privileges of either House of Parliament.
Disapplies
Trigger
Processing to assess a person's suitability for judicial office or the office of King's Counsel, and processing by an individual acting in a judicial capacity or a court or tribunal acting judicially. Otherwise applies to the extent that applying the provisions would be likely to prejudice judicial independence or judicial proceedings.
Disapplies
Trigger
Processing to confer a Crown honour or dignity, or to assess a person's suitability for one of the offices listed, which the Secretary of State can amend by regulations.
Disapplies
Trigger
A controller need not comply with a subject access request to the extent that doing so would disclose information about another identifiable individual, unless that person has consented or it is reasonable to disclose without consent. Reasonableness takes account of any duty of confidentiality, the steps taken to seek consent, whether the other person can consent, and any express refusal. Disclosure without consent is treated as reasonable for health workers, social workers and education workers named in the records (para 17).
Disapplies
The exemption most often engaged in practice. It permits redaction, not refusal of the whole request.
Trigger
Information in respect of which a claim to legal professional privilege, or in Scotland confidentiality of communications, could be maintained in legal proceedings, or which is subject to a duty of confidentiality owed by a professional legal adviser to a client.
Disapplies
A class exemption with no prejudice test. The DUAA 2025 (s.79) added an equivalent exemption for law enforcement processing under Part 3.
Trigger
A person need not comply to the extent that compliance would reveal evidence of the commission of an offence and expose them to proceedings for it. It does not cover offences under the DPA 2018 itself or perjury-type offences, and information disclosed in response to a subject access request is not admissible against the person in proceedings for a DPA 2018 offence.
Disapplies
Trigger
Processing for a corporate finance service provided by a relevant person, to the extent that applying the provisions would be likely to affect the price of an instrument, or where it could affect a person's decisions on an instrument or business and would have a prejudicial effect on the orderly functioning of financial markets or the efficient allocation of capital in the economy.
Disapplies
Trigger
Processing for management forecasting or management planning about a business or other activity, to the extent that applying the provisions would be likely to prejudice the conduct of that business or activity.
Disapplies
Trigger
Records of the controller's intentions in negotiations with the data subject, to the extent that applying the provisions would be likely to prejudice those negotiations.
Disapplies
Trigger
References given, or to be given, in confidence for the education, training or employment of the data subject, a volunteer placement, an appointment to office, or the provision of a service by the data subject. No prejudice test: the confidence is enough.
Disapplies
Covers the reference in the hands of the giver and of the recipient.
Trigger
Information recorded by candidates during an exam is exempt from access. For exam marks, the time to respond to an access request made before results are announced is extended to the earlier of five months from the request or 40 days after the results are announced.
Disapplies
Trigger
Processing with a view to publication of journalistic, academic, artistic or literary material, where the controller reasonably believes publication would be in the public interest and reasonably believes that applying a provision would be incompatible with the special purposes. In judging the public interest the controller must have regard to the relevant codes, including the BBC Editorial Guidelines, the Ofcom Broadcasting Code and the Editors' Code of Practice, and the regulator's journalism code under s.124.
Disapplies
The widest exemption in the Schedule, matched by the s.124 journalism code in force since 2024-02-22.
Trigger
Processing for scientific or historical research or statistical purposes, to the extent that applying the provisions would prevent or seriously impair those purposes. The Art 89(1) safeguards must be in place, and for the access right the results must not be made available in a form that identifies data subjects.
Disapplies
Trigger
Processing for archiving purposes in the public interest, to the extent that applying the provisions would prevent or seriously impair those purposes, with the Art 89(1) safeguards in place.
Disapplies
Trigger
Health data in a report or other evidence given to a court in specified proceedings (for example children's and family proceedings) which the court may withhold from the data subject under the applicable rules in England and Wales, Scotland or Northern Ireland.
Disapplies
Trigger
A request made under an enactment or rule of law by a person with parental responsibility for a child (under 18 in England, Wales and Northern Ireland; under 16 in Scotland) or by a court-appointed manager, for health data that the data subject provided in the expectation it would not be disclosed to the requester, or that the data subject has asked not to be disclosed.
Disapplies
Trigger
Access is disapplied to the extent that complying would be likely to cause serious harm to the physical or mental health of the data subject or another individual. A controller that is not a health professional may rely on it only with a recent opinion from the appropriate health professional that the serious harm test is met.
Disapplies
Trigger
A restriction, not an exemption: a controller that is not a health professional must not disclose health data in response to an access request without first obtaining an opinion from the appropriate health professional that the serious harm test is not met, unless the data subject has already seen or knows about the information.
Disapplies
Trigger
Social work data in a report or evidence given to a court in specified proceedings that the court may withhold from the data subject under the applicable rules.
Disapplies
Trigger
The same structure as the health data rule: a request by a person with parental responsibility or a court-appointed manager, for social work data provided in the expectation of non-disclosure to the requester or which the data subject has asked to be withheld.
Disapplies
Trigger
Access is disapplied to the extent that complying would be likely to prejudice the carrying out of social work because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
Disapplies
Trigger
A restriction for Scottish social work authorities: where data came from the Principal Reporter for children's hearings, the authority must tell the Reporter within 14 days of the request and may not disclose unless the Reporter gives the opinion that the serious harm test is not met.
Disapplies
Territorial limit
Scotland only.
Trigger
Education data in a report or evidence given to a court in specified proceedings that the court may withhold from the data subject under the applicable rules.
Disapplies
Trigger
Access is disapplied to the extent that complying would be likely to cause serious harm to the physical or mental health of the data subject or another individual. Education data means educational records held by schools in England and Wales and Northern Ireland, and records processed by Scottish education authorities.
Disapplies
Trigger
A restriction for Scottish education authorities: where the authority believes data came from the Principal Reporter, it may not disclose in response to an access request unless the Reporter gives the opinion that the serious harm test is not met.
Disapplies
Territorial limit
Scotland only.
Trigger
A request made under an enactment or rule of law by a person with parental responsibility for a child under 18, or by a court-appointed manager, for data about physical injury to, or physical or emotional neglect, ill-treatment or sexual abuse of, the data subject. Access is disapplied to the extent that complying would not be in the best interests of the data subject.
Disapplies
Territorial limit
England, Wales and Northern Ireland only. The exemption cannot apply in Scotland, which makes it the clearest territorial asymmetry in the Act.
Trigger
Personal data whose disclosure is prohibited or restricted by sections 31, 31ZA to 31ZE and 33A to 33D of the Human Fertilisation and Embryology Act 1990.
Disapplies
Trigger
Personal data whose disclosure is prohibited or restricted by the adoption enactments listed for England and Wales, Scotland and Northern Ireland, such as the Adoption Agencies Regulations and the court rules on adoption proceedings.
Disapplies
The enactments differ by nation; the exemption follows whichever restriction applies.
Trigger
Personal data whose disclosure is restricted by the special educational needs and additional support for learning rules in England, Scotland and Northern Ireland.
Disapplies
Trigger
Personal data whose disclosure is restricted by the enactments governing parental orders after surrogacy, as applied by the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 in each nation.
Disapplies
Trigger
Personal data whose disclosure is restricted by s.178 of the Children's Hearings (Scotland) Act 2011 or the children's hearings procedure rules.
Disapplies
Territorial limit
Scotland only.
| Instrument | Year | Effect |
|---|---|---|
| Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 | 2019 | Created the UK GDPR by onshoring Regulation (EU) 2016/679. |
| Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (SI 2024/342) | 2024 | In force 2024-03-08. Rewrote the immigration exemption, putting its safeguards into the Act itself (new Sch 2 paras 4A and 4B) after the Court of Appeal held the 2022 policy document approach unlawful. |
| Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 | 2022 | Added the immigration exemption policy-document safeguard and the vulnerability and Convention-rights considerations. |
| Retained EU Law (Revocation and Reform) Act 2023 | 2023 | Removed the supremacy of EU law over UK statute from 2024-01-01, so where the UK GDPR and a Schedule 2 exemption cannot be read together the exemption prevails (see the answered questions below). |
| Data (Use and Access) Act 2025 | 2025 | The largest substantive amendment to date: recognised legitimate interests (no balancing test for a defined list of purposes); reformed automated decision-making (Arts 22A–22D, permitting more automated significant decisions with safeguards); a codified "reasonable and proportionate" standard for subject access searches with a stop-the-clock provision; and restructuring of the ICO into an Information Commission, a board replacing the corporation-sole Commissioner. Commenced in stages: the subject access search standard at Royal Assent (2025-06-19, treated as in force from 2024-01-01); the main data protection tranche on 2026-02-05 (SI 2026/82); the complaints duty on 2026-06-19 (SI 2026/82); the Information Commission on 2026-09-30 (SI 2026/1015). See the commencement tracker. |
The cross-instrument texture that profiling an Act in isolation misses, including where the real answer to a question about this Act is found in a different one.
| Instrument | Relationship | Note |
|---|---|---|
| Data (Use and Access) Act 2025 | Amended by | Amended in place: complaints (s.164A), enforcement powers, Parts 3 and 4, and the regulator, now the Information Commission. See the track changes and the commencement tracker. |
| UK GDPR | Reads with | Inseparable: read as a single regime via the Keeling-schedule construction. The DPA cannot be interpreted in isolation from it. |
| Privacy and Electronic Communications Regulations 2003 (PECR) | Lex specialis | Lex specialis for direct marketing and cookies. Amended by the DUAA to add consent-free exceptions for low-risk storage and access (in force 2026-02-05), with PECR fines raised to UK GDPR levels from the same date. |
| Freedom of Information Act 2000 | Cross-reference | The s.40 FOIA exemption routes personal-data requests back through the DPA's framework, and DPA s.173 builds directly on an equivalent FOIA offence. Note the devolution contrast: FOI is devolved in Scotland (Freedom of Information (Scotland) Act 2002, separate regulator, separate 20-working-day public-interest-test rule) while data protection is reserved, the two Acts diverge in exactly opposite directions on devolution. |
| Fraud Act 2006 / Computer Misuse Act 1990 | Escalation route | Because s.170 is fine-only, a sophisticated or high-harm breach a prosecutor feels merits custody is often charged under these instead. The honest answer to "what is my criminal exposure for unlawfully accessing data?" frequently is not found in the DPA 2018 at all. |
| Investigatory Powers Act 2016 | Overlapping oversight | Governs the intelligence-services processing that Part 4 DPA sits alongside; oversight is shared between the Information Commission and the Investigatory Powers Commissioner. |
The questions this instrument most often raises, with the answer and the authority for it.
Where the two cannot be read together, yes: the Act prevails. Since 2024-01-01 the UK GDPR is assimilated law, and under section 5(A2) of the European Union (Withdrawal) Act 2018 it must be read compatibly with domestic enactments so far as possible and is subject to them where it cannot be. The protections added by DUAA 2025 s.106 (DPA 2018 ss.183A, 183B and 186) stop other legislation overriding the data protection rules, but s.183A(2)(a) excludes the data protection legislation itself, and the Explanatory Notes confirm that protection does not apply to it. So read each Schedule 2 exemption, as far as its words allow, as limited to what is necessary and proportionate under Article 23(1), and compatibly with Article 8 ECHR under s.3 of the Human Rights Act 1998; where the words do not allow that, the exemption applies as written. Disapplying an exemption for breach of Article 23, as the Court of Appeal did to the immigration exemption in R (Open Rights Group) v Secretary of State for the Home Department [2021] EWCA Civ 800, is no longer available; the remedy for an exemption that breaches Article 8 is a declaration of incompatibility. The immigration exemption now carries its safeguards in the Act itself (SI 2024/342).
As far as a reasonable and proportionate search would reach, across the whole organisation. DUAA s.78 inserted UK GDPR Art 15(1A), which limits the entitlement to what the controller can provide on such a search; it has effect from 2024-01-01. It codifies the test the Court of Appeal applied under the 1998 Act in Dawson-Damer v Taylor Wessing LLP [2017] EWCA Civ 74 and Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd [2017] EWCA Civ 121: the duty is to search reasonably and proportionately, and proportionality limits the search, not the right. In Ashley v HMRC [2025] EWHC 134 (KB) the High Court held that a controller must search every part of the organisation where the data may be held, cannot confine the search to the team that received the request, and cannot treat the hours a search takes as disproportionate in themselves given its size and resources. Record what was searched and why the search stopped. The s.76 time limits and stop-the-clock rules apply to requests received from 2026-02-05.
Decide who must be told about a personal data breach, and by when.
Start from what you are trying to do and get the UK GDPR basis to test first, with the extra condition you need for special category data.
Find the route for sending personal data out of the UK: adequacy regulations, a UK safeguard, or a derogation.
Check an online service likely to be accessed by children against the Age Appropriate Design Code's fifteen standards and the DUAA duty on children's higher protection matters.
Check a controller's complaints process against the duty that applies to complaints received from 2026-06-19.
Work through a transfer of personal data out of the UK: is it restricted, which route applies, and is the data protection test met and recorded?
Check a record of processing activities holds every field Art 30(1) requires of a controller.
Work a subject access request from receipt to response, recording each decision that stops the clock, extends it or narrows the search.
Find an Art 9(2) condition for special category data, and the DPA 2018 Schedule 1 condition where the UK requires one.
| Activity | Role here | Provisions |
|---|---|---|
| Email and text marketing | Interacts | s.122 (direct marketing code); Part 6 |
| Cookies, pixels and device tracking | Interacts | Part 6 |
| Personal data breach | Interacts | s.173; s.155 |
| Requests for a person's own data | Primary | s.15, Schs 2 to 4; s.173 |
| Automated decisions and AI | Also applies | s.50 (Part 3); Part 4 |
| Online services likely to be used by children | Primary | s.9; s.123 (Age Appropriate Design Code) |
| Scientific research and statistics | Also applies | Sch 1 para 4; Sch 2 Part 6 |
| Sending data outside the UK | Also applies | s.119A; Part 3 transfers |
| Law enforcement processing | Primary | Part 3 (ss.29 to 81) |
| Workplace monitoring and CCTV | Also applies | Sch 1 para 1 |
| Public sector data sharing | Primary | s.8; s.121 (data sharing code) |
| Complaints about personal data handling | Primary | s.164A; s.165 |
Updated