Data Protection Act 2018

Data Protection Act 2018
Act of Parliament
	Parliament of the United Kingdom
Long title	An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.
Citation	2018 c. 12
Introduced by	Matt Hancock (Commons); Henry Ashton, 4th Baron Ashton of Hyde (Lords)
Territorial extent	United Kingdom
Dates
Royal assent	23 May 2018
Commencement	Fully in force as of 2 December 2019
Other legislation
Amends	Registration Service Act 1953; Dentists Act 1984; Opticians Act 1989; Human Fertilisation and Embryology Act 1990; Health Service Commissioners Act 1993; Immigration and Asylum Act 1999; Terrorism Act 2000; Political Parties, Elections and Referendums Act 2000; Anti-terrorism, Crime and Security Act 2001; Scottish Public Services Ombudsman Act 2002; Domestic Violence, Crime and Victims Act 2004; Public Audit (Wales) Act 2004; Constitutional Reform Act 2005; Mental Capacity Act 2005; National Health Service Act 2006; National Health Service (Wales) Act 2006; Criminal Justice and Immigration Act 2008; Counter-Terrorism Act 2008; Borders, Citizenship and Immigration Act 2009; Terrorist Asset-Freezing etc. Act 2010; Charities Act 2011; Protection of Freedoms Act 2012; Modern Slavery Act 2015; Counter-Terrorism and Security Act 2015; Investigatory Powers Act 2016; Policing and Crime Act 2017; Children and Social Work Act 2017; Digital Economy Act 2017;
Repeals/revokes	Data Protection Act 1998
Amended by	European Parliamentary Elections Etc. (Repeal, Revocation, Amendment and Saving Provisions) (United Kingdom and Gibraltar) (EU Exit) Regulations 2018; Public Services Ombudsman (Wales) Act 2019; Consumer Protection (Enforcement) (Amendment etc.) (EU Exit) Regulations 2019; Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019; UK Statistics (Amendment etc.) (EU Exit) Regulations 2019; Financial Services and Markets Act 2000 (Prospectus) Regulations 2019 (revoked); Sentencing Act 2020; Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020; Armed Forces Act 2021; UK Statistics (Amendment etc.) (EU Exit) Regulations 2021; Age of Criminal Responsibility (Scotland) Act 2019 (Consequential Provisions and Modifications) Order 2021; Advanced Research and Invention Agency Act 2022; Adoption and Children Act (Northern Ireland) 2022; Health and Care Act 2022; Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022; Health and Social Care Act (Northern Ireland) 2022 (Consequential Amendments) Order 2022; Northern Ireland Troubles (Legacy and Reconciliation) Act 2023; Veterans Advisory and Pensions Committees Act 2023; Levelling-up and Regeneration Act 2023; Health and Social Care Information Centre (Transfer of Functions, Abolition and Transitional Provisions) Regulations 2023; Data Protection Act 2018 (Transitional Provision) Regulations 2023; Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023; Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendment) Regulations 2023; Victims and Prisoners Act 2024; Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024; Anaesthesia Associates and Physician Associates Order 2024; Data (Use and Access) Act 2025; Border Security, Asylum and Immigration Act 2025; Employment Rights Act 2025; Disclosure (Scotland) Act 2020 (Consequential Provisions and Modifications) Order 2025; Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025; Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026; Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026;
Relates to	General Data Protection Regulation; Data Protection Act 1998;
Status: Amended
History of passage through Parliament
Text of statute as originally enacted
Revised text of statute as amended
Text of the Data Protection Act 2018 as in force today (including any amendments) within the United Kingdom, from legislation.gov.uk.

The Data Protection Act 2018 (c. 12) is an act of the Parliament of the United Kingdom which updates data protection laws in the UK. It is a national law which complements the European Union's General Data Protection Regulation (GDPR) and replaces the Data Protection Act 1998.

The act was to be significantly amended by the Data Protection and Digital Information Bill. That bill was abandoned due to the 2024 United Kingdom general election, but the phased implementation of the Data (Use and Access) Act 2025 will make changes to the operation of the 2018 Act.