Codes of practice map
The layer between the statute and the practice: statutory codes (which courts and regulators must take into account) and the regulators' key guidance (which they do not), for data protection, PECR and both FOI regimes. Each line is an instrument the code sits under.
Statutory code Guidance Select a box to jump to its entry.
Age Appropriate Design Code
- Basis
- DPA 2018 s.123
- Issued by
- Information Commission
- Legal effect
- Statutory code under s.127, in force since 2020-09-02 with a twelve-month transition to 2021-09-02. Fifteen standards for online services likely to be accessed by children.
- Covers
- Design of online services likely to be accessed by children.
- Sits under
- DPA 2018, UK GDPR
- Put it into practice
- Children's data by design
Anonymisation and pseudonymisation guidance
- Basis
- Regulator guidance (non-statutory)
- Issued by
- Information Commission
- Legal effect
- Not binding. Published 2025-03-28; reflects the regulator's view of when data stops being personal data. The regulator has said it is reviewing the guidance for the DUAA.
- Covers
- Identifiability, anonymisation techniques, pseudonymisation and the s.171 re-identification offence.
- Sits under
- UK GDPR, DPA 2018
- Put it into practice
- Anonymisation and pseudonymisation
Data protection and journalism code of practice
- Basis
- DPA 2018 s.124
- Issued by
- Information Commission
- Legal effect
- Statutory code under s.127, in force since 2024-02-22. Courts, tribunals and the regulator must take it into account on the special purposes exemption in DPA 2018 Sch 2 para 26.
- Covers
- Processing for journalism and the special purposes exemption.
- Sits under
- DPA 2018
Data sharing code of practice
- Basis
- DPA 2018 s.121
- Issued by
- Information Commission (issued by the Commissioner)
- Legal effect
- In force since 2021-10-05. Admissible in proceedings, and courts, tribunals and the regulator must take relevant provisions into account (DPA 2018 s.127). Not law in itself, but departing from it needs a reason.
- Covers
- Sharing personal data between controllers, including public sector sharing and data sharing agreements.
- Sits under
- DPA 2018, UK GDPR
- Put it into practice
- Records of processing (Art 30), Disclosures to third parties
List of processing operations requiring a DPIA
- Basis
- UK GDPR Art 35(4)
- Issued by
- Information Commission
- Legal effect
- Published under a statutory duty: processing on the list is treated as likely to result in high risk, so a DPIA is required.
- Covers
- When a DPIA is mandatory beyond the Art 35(3) cases.
- Sits under
- UK GDPR
- Put it into practice
- DPIA screening, Data protection impact assessments that are worth doing
Direct marketing code of practice
- Basis
- DPA 2018 s.122
- Issued by
- Information Commission
- Legal effect
- No statutory code is in force. The regulator consulted on a draft s.122 code in 2020 but never brought one into force, so there is no s.127 code to take into account. The regulator's non-statutory direct marketing guidance applies instead, including its guidance on the charitable purpose soft opt-in added by the DUAA.
- Covers
- Direct marketing under PECR and the UK GDPR.
- Sits under
- PECR, UK GDPR, DPA 2018
- Put it into practice
- Electronic marketing permission
Guide to PECR
- Basis
- Regulator guidance (non-statutory)
- Issued by
- Information Commission
- Legal effect
- Not binding. The regulator's reading of PECR, including breach reporting and, in final guidance published 2026-04-29, the storage and access exceptions added by the DUAA 2025.
- Covers
- Marketing, cookies and storage and access, security breaches for communications providers.
- Sits under
- PECR
- Put it into practice
- Cookie and storage exemption audit, Electronic marketing permission, Breach: should the Information Commission be told?
Code of practice under the Environmental Information Regulations
- Basis
- EIR 2004 reg 16
- Issued by
- Secretary of State
- Legal effect
- Guidance on discharging EIR obligations; conformity can be enforced through practice recommendations.
- Covers
- Handling environmental information requests.
- Sits under
- EIR 2004
- Put it into practice
- EIR request response (EIR 2004)
Code of practice on the discharge of public authorities' FOI functions
- Basis
- FOIA 2000 s.45
- Issued by
- Cabinet Office (Minister for the Cabinet Office)
- Legal effect
- Not binding, but the regulator can issue a practice recommendation where an authority does not conform (FOIA 2000 s.48). Covers internal review timescales.
- Covers
- Advice and assistance, transferring requests, consultation, internal review (20 working days, 40 at most).
- Sits under
- FOIA 2000
- Put it into practice
- FOI request response (FOIA 2000)
Code of practice on the management of records
- Basis
- FOIA 2000 s.46
- Issued by
- Secretary of State (with The National Archives)
- Legal effect
- Not binding; practice recommendations under s.48 for non-conformity.
- Covers
- Records management for public authorities, so information can be found when requested.
- Sits under
- FOIA 2000
- Put it into practice
- FOI request response (FOIA 2000), Retention: schedules, deletion and the backup gap
Scottish Ministers' code of practice on FOISA functions
- Basis
- FOISA 2002 s.60
- Issued by
- Scottish Ministers
- Legal effect
- The Scottish Information Commissioner can issue a practice recommendation for non-conformity (FOISA 2002 s.44).
- Covers
- Handling requests by Scottish public authorities.
- Sits under
- FOISA 2002, EIRS 2004
- Put it into practice
- Scottish FOI and EIR response (FOISA 2002, EIRS 2004)
Scottish Ministers' code of practice on records management
- Basis
- FOISA 2002 s.61
- Issued by
- Scottish Ministers
- Legal effect
- Practice recommendation for non-conformity (FOISA 2002 s.44).
- Covers
- Records management for Scottish public authorities.
- Sits under
- FOISA 2002
- Put it into practice
- Retention: schedules, deletion and the backup gap