Data Protection Act 2018

Return to Glossary

Data Protection Act 2018 controls how your personal information is used by organisations, businesses or the government. It is the United Kingdom's implementation of the General Data Protection Regulation (GDPR).

Under the Data Protection Act 2018, you have the right to find out what information the government and other organisations store about you. These include the right to:

bEveryone responsible for using personal data has to follow strict rules called ‘data protection principles’. They must make sure the information is:

used fairly, lawfully and transparentlyused for specified, explicit purposesused in a way that is adequate, relevant and limited to only what is necessaryaccurate and, where necessary, kept up to datekept for no longer than is necessaryhandled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damageThere is stronger legal protection for more sensitive information, such as:

raceethnic backgroundpolitical opinionsreligious beliefstrade union membershipgeneticsbiometrics (where used for identification)healthsex life or orientationThere are separate safeguards for personal data relating to criminal convictions and offences.

Source: https://www.gov.uk/data-protection