Statutory overlap map

Email and text marketing

Sending marketing by email, text or other electronic mail to individuals.

• PECR Primary regs 22 and 23

  Decides whether the message may be sent at all: consent, the soft opt-in or the charity soft opt-in.

• UK GDPR Also applies Art 6; Art 21(2) and (3)

  A lawful basis is still needed for the processing, and an objection to direct marketing is absolute.

• DPA 2018 Interacts s.122 (direct marketing code); Part 6

  Supplies the code of practice and, since 2026-02-05, the enforcement toolkit used for PECR breaches.

Where they pull apart. PECR decides whether you may send; the UK GDPR decides whether you may use the data to do it. Passing one test does not pass the other, and PECR prevails on the sending question.

Checklists: Electronic marketing permission

Telephone marketing

Live and automated marketing calls.

• PECR Primary regs 19 and 21

  Automated calls need consent; live calls must be screened against the Telephone Preference Service and the sender's own list.

• UK GDPR Also applies Art 6; Art 21

  Lawful basis for the calling list, and the absolute right to object.

Where they pull apart. A number on the TPS cannot be called live for marketing even where the UK GDPR analysis would allow the processing.

Checklists: Electronic marketing permission

Cookies, pixels and device tracking

Storing information on, or reading it from, a user's device: cookies, local storage, pixels, SDKs, fingerprinting.

• PECR Primary reg 6; Sch A1

  Consent for the storage or access unless a Schedule A1 exception applies.

• UK GDPR Also applies Art 6; Art 22A where profiling feeds significant decisions

  Governs what you then do with any personal data collected.

• DPA 2018 Interacts Part 6

  Enforcement of PECR now runs through the DPA 2018 toolkit.

Where they pull apart. The PECR analytics exception removes the need for consent to the storage. It does not supply a UK GDPR lawful basis for later use of the data.

Checklists: Cookie and storage exemption audit

Personal data breach

A security incident leading to loss, alteration, disclosure of or access to personal data.

• UK GDPR Primary Arts 33 and 34

  Regulator within 72 hours where there is a risk; individuals where the risk is high.

• PECR Lex specialis reg 5A

  Communications providers also notify under PECR within 72 hours of awareness, with a different test for telling subscribers.

• DPA 2018 Interacts s.173; s.155

  Penalty exposure, and a criminal offence if records are destroyed after a subject access request.

Where they pull apart. For a communications provider both duties run. PECR tells subscribers where the breach is likely to adversely affect them; the UK GDPR test for individuals is high risk.

Checklists: Breach: should the Information Commission be told?

Requests for a person's own data

Someone asks an organisation what it holds about them.

• UK GDPR Primary Arts 12 and 15

  The right of access, its deadline and the reasonable and proportionate search limit.

• DPA 2018 Primary s.15, Schs 2 to 4; s.173

  The exemptions with their trigger tests, and the criminal backstop.

• FOIA 2000 Interacts s.40(1)

  A request to a public authority for the requester's own data is not an FOI request: it is handled as subject access.

• FOISA 2002 Interacts s.38

  The same routing applies in Scotland.

Checklists: Subject access: intake and stop-the-clock assessment

FOI requests for someone else's personal data

A public authority is asked to disclose information about a third party.

• FOIA 2000 Primary s.40(2)

  Third-party personal data is exempt where disclosure would breach the data protection principles.

• FOISA 2002 Primary s.38

  The Scottish equivalent for Scottish public authorities.

• UK GDPR Also applies Art 5(1)(a); Art 6(1)(f)

  The disclosure test borrows the lawfulness and fairness analysis.

Where they pull apart. In Scotland two regulators touch one request: the Scottish Information Commissioner decides the FOISA request, while the data protection law applied inside it is regulated UK-wide by the Information Commission.

Checklists: FOI request response (FOIA 2000), Scottish FOI and EIR response (FOISA 2002, EIRS 2004)

Requests for environmental information

Requests about the state of the environment, emissions, land use, and measures affecting them.

• EIR 2004 Primary regs 5, 12 and 13

  The regime for authorities in England, Wales and Northern Ireland and UK-wide bodies.

• EIRS 2004 Primary regs 5, 10 and 11

  The regime for Scottish public authorities.

• FOIA 2000 Interacts s.39

  Environmental information is exempt under FOIA so that the EIR applies instead.

• FOISA 2002 Interacts s.39

  The Scottish equivalent routing.

Where they pull apart. The requester does not choose the regime. If the information is environmental, the EIR applies even if FOIA was cited.

Checklists: EIR request response (EIR 2004), Scottish FOI and EIR response (FOISA 2002, EIRS 2004)

Automated decisions and AI

Decisions about people made by algorithms, scoring models or AI systems.

• UK GDPR Primary Arts 22A to 22D; Art 35

  Significant solely automated decisions permitted with safeguards, tighter for special category data. DPIA usually required.

• DPA 2018 Also applies s.50 (Part 3); Part 4

  Law enforcement and intelligence services have their own automated decision rules.

Checklists: Automated decision safeguards (Arts 22A to 22D), DPIA screening

Online services likely to be used by children

Apps, games, platforms and connected devices children are likely to access.

• UK GDPR Primary Art 8; Art 25

  Digital consent age of 13, and design that accounts for children's higher protection matters.

• DPA 2018 Primary s.9; s.123 (Age Appropriate Design Code)

  The consent age and the statutory code.

• PECR Also applies reg 6; Sch A1

  Cookie consent rules apply on children's services too.

Checklists: Children's data by design, DPIA screening, Cookie and storage exemption audit

Scientific research and statistics

Research, including commercially funded research, and statistical analysis using personal data.

• UK GDPR Primary research definitions; consent to an area of research; research safeguards

  Statutory meaning of research and statistical purposes, broad consent and safeguards (in force 2026-02-05).

• DPA 2018 Also applies Sch 1 para 4; Sch 2 Part 6

  Special category condition and research exemptions.

Checklists: Special category condition, DPIA screening

Sending data outside the UK

Transfers to a receiver in another country, including cloud and support access.

• UK GDPR Primary Chapter V

  Adequacy regulations, Art 46 safeguards with the data protection test, or Art 49 derogations.

• DPA 2018 Also applies s.119A; Part 3 transfers

  Standard clauses issued by the regulator (IDTA, Addendum), and separate law enforcement transfer rules.

Checklists: Restricted transfer check

Law enforcement processing

Processing by police and other competent authorities for law enforcement purposes.

• DPA 2018 Primary Part 3 (ss.29 to 81)

  Its own principles, rights, exemptions and transfer rules, separate from the UK GDPR.

• UK GDPR Interacts Art 2

  The same body is under the UK GDPR for its non-law-enforcement processing, such as HR.

Where they pull apart. One organisation, two regimes: a police force is Part 3 for investigations and UK GDPR for its staff records.

Workplace monitoring and CCTV

Monitoring staff, premises, devices or communications.

• UK GDPR Primary Arts 5, 6, 13, 35

  Lawful basis, transparency and usually a DPIA.

• DPA 2018 Also applies Sch 1 para 1

  Special category data in employment needs the Schedule 1 condition and an appropriate policy document.

• FOIA 2000 Interacts s.40

  CCTV held by a public authority can be requested; third-party images engage s.40(2).

Checklists: DPIA screening, Special category condition

Public sector data sharing

Public authorities sharing personal data with each other or with partners.

• UK GDPR Primary Art 6(1)(e); Art 6(1) final subparagraph

  Public task is the usual basis; legitimate interests is not available to authorities performing their tasks.

• DPA 2018 Primary s.8; s.121 (data sharing code)

  Public task defined, and the statutory data sharing code.

• FOIA 2000 Interacts Part I

  Data sharing agreements can themselves be requested under FOI.

Checklists: Records of processing (Art 30), DPIA screening

Using suppliers to process data

Cloud, payroll, IT support or any supplier processing personal data for you.

• UK GDPR Primary Art 28; Art 32

  A contract with the required terms, and security.

• PECR Interacts reg 5A

  A communications provider's processors must report breaches so the provider can meet its 72-hour duty.

Checklists: Processor contract terms (Art 28), Restricted transfer check

Complaints about personal data handling

A person complains that their data has been mishandled.

• DPA 2018 Primary s.164A; s.165

  Controller complaints duty from 2026-06-19, then complaint to the regulator.

• UK GDPR Also applies Art 77; Art 82

  Right to complain to the regulator and to claim compensation.

Checklists: Data protection complaints (s.164A)