1. Section 1: Understanding UK data protection law

1.1. 1.1 The current legal framework

UK data protection learning

1.1 The current legal framework

How the UK GDPR, DPA 2018, DUAA 2025 and ICO fit together.

The two main instruments

UK General Data Protection Regulation

The UK GDPR sets the main rules for processing personal data. It covers principles, lawful bases, individual rights, accountability, security, international transfers and regulatory powers.

Data Protection Act 2018

The DPA 2018 complements the UK GDPR. It contains UK-specific provisions, exemptions, rules for law-enforcement processing, rules for intelligence services and criminal offences relating to personal data.

The Data (Use and Access) Act 2025

The DUAA amended parts of the UK's data protection framework. Relevant changes now in force include a seventh Article 6 lawful basis called recognised legitimate interest, changes affecting some rights and automated decision-making provisions, and a statutory process for data protection complaints.

Avoid an outdated statement: It is no longer accurate to teach that the UK GDPR has only six lawful bases. There are currently seven.

Who regulates the law?

The Information Commissioner's Office (ICO) is the UK's independent regulator for data protection and information rights. It publishes guidance, considers complaints, investigates organisations and can use enforcement powers.

Knowledge checkpoint

Answer each question before opening the suggested answer.

1. Which two instruments form the main foundation of everyday UK data protection compliance?

Suggested answer: The UK GDPR and the Data Protection Act 2018, read together and as amended by later legislation.

2. What is the ICO?

Suggested answer: The UK's independent regulator for data protection and information rights.

3. Why must training resources be reviewed periodically?

Suggested answer: Legislation, commencement dates, court decisions, ICO guidance and organisational processes can change.

Official reference points

Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.