Data protection legislation sets out rules and standards for the use and handling (‘processing’) of information (‘personal data’) about living identifiable individuals (‘data subjects’) by organisations (‘data controllers’). It is based around the notions of principles, rights and accountability obligations.
The law applies to organisations in all sectors, both public and private. It applies to all electronic records as well as many paper records. It doesn’t apply to anonymous information or to information about the deceased.
Since 1 January 2021, the principal legislation has been the UK version of the General Data Protection Regulation (the ‘UK GDPR’), coupled with the Data Protection Act 2018 (DPA 2018) that supplements the UK GDPR in specific ways. The UK GDPR is almost identical to the EU-wide GDPR that applied from 25 May 2018 to 31 December 2020, with minor technical changes to allow its provisions to work within a UK-only context.
The EU GDPR itself replaced the Data Protection Act 1998 (DPA 1998) and the numerous Statutory Instruments issued pursuant to it. There is also supplementary data protection legislation covering specific topics, such as direct marketing. The legislation is regulated in the UK by the Information Commissioner’s Office (ICO) as well as the courts. The DPA 2018 delineates the regulatory powers of the ICO as well as introducing various criminal offences.