The UK GDPR is the retained EU regulation as it now stands in UK law. It sits beside the Data Protection Act 2018, and both were changed by the Data (Use and Access) Act 2025. This list gathers the duties on a controller or processor by article and section, with the UK points: recognised legitimate interests, automated decisions, complaints handling, UK transfer rules and the offences. PECR, the separate law on cookies and electronic marketing, is not covered.
Free account needed to download. You come straight back to the file.
Who it is for. Organisations established in the United Kingdom, and organisations elsewhere, including Indian exporters and service providers, that offer goods or services to people in the UK or monitor their behaviour there.
What this list covers. UK GDPR as revised on legislation.gov.uk, read from archived copies of its article pages (captured between August 2025 and October 2026), with the in-force notes beside each provision; selected sections and schedules of the Data Protection Act 2018 and the Data (Use and Access) Act 2025 on the same site; commencement regulations S.I. 2025/904, 2026/82 and 2026/1015; and the Information Commissioner's Office's commencement statement and guidance. Read on 7 November 2026. Check for later changes.: 125 obligations. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it asks for |
|---|---|---|
| Art. 3(1) | Established in the UK | The UK GDPR covers personal data handled in the context of a UK establishment of a controller or processor, whether or not the handling itself takes place in the UK. |
| Art. 3(2) | Based abroad but serving the UK | If you are outside the UK, the UK GDPR still applies when you offer goods or services to people in the UK, paid or free, or monitor their behaviour in the UK. Indian exporters and outsourcers should test themselves against this. |
| DPA 2018 s. 207 | Territorial reach of the Act | The 2018 Act's duties and offences follow the UK GDPR's reach under Article 3. For other processing they apply where it is carried out in the context of a UK establishment. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 5(1) | Principles | Use personal data lawfully, fairly and openly, for clear purposes, in the amount needed, accurately, for no longer than necessary, and securely. |
| Art. 5(2) | Accountability | Be able to show, with records and evidence, that each of the principles is being met. A statement that you comply is not enough. |
| Art. 6(1) | Lawful basis | Pick and record a lawful basis for each purpose before you start: consent, contract, legal duty, vital interests, public task, recognised legitimate interest or legitimate interests. Public bodies cannot use the last two for their tasks. |
| Art. 6(1)(ea), Annex 1 | Recognised legitimate interests | From 5 February 2026 you may rely on this basis, with no balancing test, only where the use fits an Annex 1 case: disclosure for a public task, national or public security and defence, emergencies, crime or safeguarding vulnerable people. |
| Art. 6(1)(f), 6(11) | Legitimate interests | Still weigh your interest against the person's, especially a child's. The law now lists examples that may qualify: direct marketing, internal group transfers for administration, and network and information security. From 5 February 2026. |
| Art. 6(3), DPA 2018 s. 9A | Legal duty and public task need a basis in law | A legal duty or public task basis must be set by UK law. For a public task it can also rest on relevant international law, which must meet a condition in Schedule A1 to the 2018 Act. From 20 August 2025. |
| Art. 5(3), 8A | Purpose limitation and compatible re-use | Before using data for a new purpose, check it is compatible with the original: link, context, data type, effects and safeguards. Some cases count as compatible, such as consent, research or Annex 2. Compatibility gives no lawful basis. From 5 February 2026. |
| Art. 4(6)-(7) | Broad consent for scientific research | Where the purposes of a research area cannot be fully described when you ask, consent to the area counts as specific if it follows ethical norms and lets people agree to part of the research where it can. From 5 February 2026. |
| Art. 7 | Conditions for consent | Where you rely on consent, be able to prove it, ask in clear and separate wording, make it as easy to withdraw as to give, and do not make a service depend on consent it does not need. |
| Art. 8(1)-(2) | Children's consent online | For online services offered directly to a child under 13, get consent from the holder of parental responsibility and make reasonable efforts to check it. The age is set in Article 8 itself. DPA 2018 s. 9 no longer exists. |
| Art. 8(2A), 8ZA | Powers to change the age and require age checks | The Secretary of State may by regulations set a different age between 13 and 16, overall or for some services (from 29 April 2026). Article 8ZA separately allows age-verification regulations. Watch for any made. |
| Art. 9(1)-(2) | Special category data | Do not process health, biometric, genetic, race, politics, religion, union, sex life or orientation data unless you have an Article 6 basis and one of the Article 9(2) exceptions applies. |
| Art. 9(2), DPA 2018 s. 10 and Sch. 1 | UK conditions for special category data | Where an exception needs a basis in UK law (employment, substantial public interest, health, public health, research), meet a Schedule 1 condition. Substantial public interest needs a Part 2 condition. |
| DPA 2018 Sch. 1 paras. 38-40 | Appropriate policy document | Where a Schedule 1 condition calls for one, keep a written policy on how you meet the principles and on retention and erasure, review it, keep it six months after you stop, and give it to the regulator free on request. |
| DPA 2018 Sch. 1 para. 41 | Record the condition relied on | For this processing, add to your Article 30 record the condition relied on, how Article 6 is met, and whether you erase and retain the data under your policy, with reasons if you do not. |
| Art. 10, DPA 2018 ss. 10-11 | Criminal offence data | Handle data on convictions, offences and security measures only under official authority or where UK law authorises it, which means a Schedule 1 condition. It includes alleged offences and proceedings. Full registers stay with an official body. |
| Art. 11 | Data that does not identify anyone | You need not collect extra identifying data just to answer rights requests. Tell the person if you cannot identify them, and act on extra details they offer to enable the request. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 12(1) | Clear communication | Give privacy information and replies about rights in concise, plain language, in writing or electronically, or orally if the person asks and their identity is proven. Take particular care when addressing a child. |
| Art. 12(2) | Make rights easy to use | Make it easy for people to exercise their rights. Do not refuse because you cannot identify the person unless you can show that you really cannot (see Article 11). |
| Art. 12(3) | Time to reply | Reply without undue delay and within one month, counted from the latest of: getting the request, getting identity details you asked for, and being paid any permitted fee. Applies to requests received from 5 February 2026. |
| Art. 12A(3)-(4) | Extending the time | For complex or numerous requests you may add two months, by telling the person why before the first month ends. Do not extend for other reasons. |
| Art. 12A(5)-(6) | Clarifying an access request | If you reasonably need more detail to work out what an access request covers, for example because you hold a lot about the person, ask for it. The time between your question and their answer does not count. |
| Art. 12(4) | When you do not act | Tell the person without undue delay, and within the time limit, why you are not acting, that they can complain to you (DPA 2018 s. 164A) or to the regulator (s. 165), and that they can seek a court remedy. |
| Art. 12(5) | Cost and unfounded requests | Deal with requests free of charge. Charge a reasonable fee or refuse only for manifestly unfounded or excessive requests, and be ready to show why. |
| Art. 12(6) | Confirming identity | If you reasonably doubt who is asking, ask only for the extra information needed to confirm identity, and you may hold off dealing with the request until it is confirmed. From 5 February 2026. |
| Art. 13 | Information when collecting data | At collection, tell people who you are, your purposes and lawful basis, recipients, transfers abroad and safeguards used, retention, their rights including complaints to you and the regulator, and any automated decisions. |
| Art. 13(3), (5)-(7) | New purpose and research re-use | Tell people before using their data for a new purpose. Skip this only for research, archiving or statistics under Article 84B where it is impossible or disproportionate, and then protect their interests, including by publishing the information. |
| Art. 14 | Information when data comes from elsewhere | Give the same privacy information, with the source of the data, within a reasonable time and at most one month, or at first contact or first disclosure if earlier. |
| Art. 14(5)-(7) | Exceptions to telling people | You need not tell people if they already know, if it is impossible or a disproportionate effort, or if it would seriously impair the purpose. Then protect their interests, including by publishing the information. From 5 February 2026. |
| Art. 15(1)-(2) | Right of access | Confirm whether you hold a person's data, give them access and the related information, including sources, recipients, retention, the right to complain to you and the regulator, and safeguards for transfers. |
| Art. 15(1A) | Reasonable and proportionate searches | When answering an access request, search for the data and information as far as is reasonable and proportionate. Treated as applying from 1 January 2024. |
| Art. 15(3)-(4) | Copies and other people's rights | Provide a copy of what the person is entitled to, electronically if they asked that way. Charge only a reasonable fee for further copies, and do not let a copy harm other people's rights and freedoms. |
| Art. 16 | Right to rectification | Correct inaccurate data without undue delay, and complete incomplete data, including by a supplementary statement, on request. |
| Art. 17(1)-(3) | Right to erasure | Erase data without undue delay when a listed ground applies, such as no longer needed, consent withdrawn, objection upheld or unlawful processing. Weigh the exceptions, such as legal claims or research under Article 84B. |
| Art. 17(1)(g), 17(4)-(5) | Erasure after a malicious allegation (England and Wales) | In England and Wales, erase data held because of an allegation you investigated and closed, if the accuser was convicted of listed harassment or stalking offences against the person or is under a stalking protection order. From 31 March 2026. |
| Art. 18 | Right to restriction | Pause use of data while accuracy or an objection is being checked, or when use is unlawful and the person prefers restriction, or they need it for legal claims. Tell them before lifting the restriction. |
| Art. 19 | Telling recipients | Pass on any correction, erasure or restriction to each recipient of the data, unless impossible or disproportionate, and tell the person who the recipients are if they ask. |
| Art. 20 | Right to data portability | When processing is automated and rests on consent or a contract, give the data the person supplied in a structured, common, machine-readable form, and transmit it to another controller where technically feasible. |
| Art. 21(1) | Right to object | Stop processing based on public task, recognised legitimate interest or legitimate interests when a person objects on grounds of their situation, unless you show compelling grounds or need the data for legal claims. |
| Art. 21(2)-(4) | Objecting to direct marketing | Stop using data for direct marketing, including related profiling, as soon as the person objects. Bring the right to their attention clearly and separately at the latest at first contact. |
| Art. 21(5)-(6) | Online objections and research | In online services let people object using automated technical means. For research or statistics, honour an objection based on the person's situation unless the work is needed for reasons of public interest. |
| Art. 22A | Which automated decisions are covered | The rules apply to significant decisions made solely by automated processing, meaning a legal or similarly significant effect and no meaningful human involvement. Where profiling drives the outcome, take that into account. |
| Art. 22B | Limits on solely automated decisions | Make no solely automated significant decision using special category data unless the person gave explicit consent, or a contract or law requires it and a substantial public interest condition applies. Never when you rely on recognised legitimate interests. |
| Art. 22C | Safeguards for automated decisions | For a solely automated significant decision, give people information about it, let them make representations, let them obtain human intervention from you, and let them contest it. Applies to decisions taken from 5 February 2026. |
| Art. 23, DPA 2018 s. 15 and Schs. 2-4 | Exemptions from rights and duties | Check whether an exemption in Schedules 2 to 4, such as crime, legal claims, journalism, research or health, limits a right or duty in your case, and apply it only as far as it goes. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 24(1)-(2) | Responsibility of the controller | Put in place technical and organisational measures that fit the risks, review and update them, and where proportionate adopt data protection policies, so you can show processing meets the law. |
| Art. 25(1) | Data protection by design | Build privacy into the means of processing and the processing itself, taking account of the state of the art, cost, risks and context, for example with minimisation and pseudonymisation. |
| Art. 25(1A)-(1B) | Children's higher protection matters | For online services likely to be accessed by children, take into account how best to protect and support them, that they are less aware of risks and rights, and that needs differ by age and stage. From 5 February 2026. |
| Art. 25(2) | Data protection by default | Set defaults so that only data needed for each purpose is processed, in amount, extent, storage period and accessibility, and not shared with an unlimited audience without the person's action. |
| Art. 26 | Joint controllers | Where you decide purposes and means with others, agree transparently who does what, including rights requests and privacy information, and make the essence available to people. They can act against any of you. |
| Art. 27(1), (4) | UK representative | If Article 3(2) applies to you, appoint a representative in the UK in writing, mandated to be addressed by the regulator and individuals on all processing issues, in addition to or instead of you. |
| Art. 27(2) | When no UK representative is needed | No representative is needed for occasional processing that is not large-scale for special category or criminal data and is unlikely to risk people, or for public bodies. Note why you rely on this. |
| Art. 28(1) | Choosing processors | Use only processors that give sufficient guarantees of appropriate technical and organisational measures, and keep checking that they do. |
| Art. 28(2), (4) | Sub-processors | Do not let a processor engage another without your written authorisation, specific or general. With a general one, require notice of changes so you can object, and pass the same obligations down by contract. |
| Art. 28(3), (9) | Processor contract | Bind each processor in writing to your documented instructions, confidentiality, security, sub-processor rules, help with rights and breaches, return or deletion, and audits, and make it warn you of instructions that break the law. |
| Art. 28(10) | Processor that sets its own purposes | A processor that decides why and how data is used is treated as a controller for that use. Set clear limits in the contract and check what suppliers actually do. |
| Art. 29 | Acting only on instructions | Make sure a processor, and anyone working under your authority, handles personal data only on your instructions unless UK law requires otherwise. |
| Art. 30(1) | Records of processing | Keep a written record of processing: who you are, purposes, data subjects and data categories, recipients, transfers, retention limits where possible and a general description of security. |
| Art. 30(2) | Processor's records | If you are a processor, keep a record for each controller of the categories of processing, transfers and a general description of security measures. |
| Art. 30(3)-(4) | Format and access for the regulator | Keep the records in writing, including electronically, and give them to the regulator on request. |
| Art. 30(5) | Small organisations | With fewer than 250 staff you may skip the records unless your processing is likely to risk people, is not occasional, or includes special category or criminal offence data. |
| Art. 31 | Cooperating with the regulator | On request, cooperate with the regulator in its tasks, whether you are a controller, a processor or a representative. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 32(1)-(2) | Security of processing | Apply measures that fit the risk, such as pseudonymisation, encryption, confidentiality, resilience, recovery and regular testing, judging risks from loss, alteration, unauthorised disclosure or access. |
| Art. 32(4) | People acting under your authority | Take steps to make sure anyone working for you or your processor who can reach personal data uses it only on your instructions, unless UK law requires otherwise. |
| Art. 33(1) | Breach notification to the regulator | Report a personal data breach to the regulator without undue delay and within 72 hours of becoming aware where feasible, unless it is unlikely to risk people's rights. Give reasons for any delay. |
| Art. 33(2) | Processor tells the controller | If you are a processor, tell the controller without undue delay after becoming aware of a personal data breach. |
| Art. 33(3)-(4) | What the notification contains | Describe the breach, with numbers of people and records where possible, give a contact point, the likely consequences and the measures taken. Send information in phases if you cannot supply it all at once. |
| Art. 33(5) | Breach record | Document every personal data breach, including those you do not report, with the facts, effects and remedial action, in a form that lets the regulator check your compliance. |
| Art. 34(1)-(2) | Telling affected people | When a breach is likely to put people at high risk, tell them without undue delay, in clear and plain language, with a contact point, the likely consequences and the measures taken. |
| Art. 34(3)-(4) | Exceptions and the regulator's say | You need not tell people if the data was protected, for example by encryption, if you removed the high risk, or if it would be disproportionate and you inform them publicly. The regulator can require you to tell them. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 35(1)-(2) | Data protection impact assessment | Before high-risk processing, assess the impact on personal data protection and take your DPO's advice where you have one. One assessment can cover similar operations. |
| Art. 35(3)-(5) | When an assessment is required | Always assess large-scale profiling with significant effects, large-scale special category or criminal data, and large-scale monitoring of public areas. Check the regulator's published lists of what does and does not need one. |
| Art. 35(7) | What an assessment contains | Describe the processing and purposes, assess necessity and proportionality and the risks to people, and set out the measures and safeguards that address them. |
| Art. 35(9)-(11) | Views, existing assessments and review | Where appropriate seek the views of affected people. An assessment already done under a general legal impact assessment can stand for legal duty or public task processing. Review when the risk changes. |
| Art. 36 | Prior consultation | Consult the regulator before processing when your assessment shows a high risk you cannot reduce, giving it the assessment, responsibilities, purposes, safeguards and DPO contact details. |
| Art. 37(1) | Designating a DPO | Appoint a data protection officer if you are a public body, or your core activities need large-scale regular and systematic monitoring or large-scale special category or criminal offence data. |
| Art. 37(5)-(7) | Choosing and publishing the DPO | Choose the DPO for expert knowledge and ability, staff member or contractor, publish their contact details and give them to the regulator. |
| Art. 38(1)-(2) | Supporting the DPO | Involve the DPO properly and early in data protection issues, and give them the resources, access to data and processing, and time to keep their knowledge current. |
| Art. 38(3), (6) | Independence of the DPO | Do not instruct the DPO on how to do their tasks or penalise or dismiss them for doing them, let them report to top management, and avoid conflicts if they hold other roles. |
| Art. 39 | Tasks of the DPO | Make sure the DPO informs and advises staff, monitors compliance and training, advises on assessments, cooperates with the regulator and acts as its contact point, with regard to risk. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 40 | Codes of conduct | Consider adhering to an approved code of conduct for your sector, which can help show that you meet your obligations and is taken into account in assessments and fines. |
| Art. 41 | Monitoring bodies | If you monitor a code, hold accreditation, stay independent, run complaint procedures and take action, including suspension or exclusion, when members breach the code. |
| Art. 42 | Certification | Consider an approved certification, which is voluntary and transparent, lasts at most three years and does not reduce your responsibility. If you apply, give the certifier the information and access it needs. |
| Art. 43 | Certification bodies | If you issue certifications, be accredited, show independence and expertise, run transparent procedures for issuing, review and withdrawal, and handle complaints about certifications. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 44A | Conditions for any restricted transfer | Send personal data to another country or an international organisation only if the transfer is approved by regulations, has appropriate safeguards or fits an exception, and you comply with the rest of the UK GDPR. From 5 February 2026. |
| Art. 45A | Transfers approved by regulations | You may transfer to a country, sector or organisation covered by regulations under Article 45A, including earlier UK adequacy regulations. Check the current regulations before relying on them, as they can be amended or revoked. |
| Art. 45B | The data protection test | Regulations approve a country only if protection there is not materially lower than under UK law, taken as a whole. Know this test, as it also underlies the check you make for safeguard-based transfers. |
| Art. 46(1A), (6)-(7) | Safeguards and your transfer risk check | Without approval, use a listed safeguard and, acting reasonably and proportionately, consider that protection after transfer is not materially lower than under UK law. Keep that transfer risk assessment on file. |
| Art. 46(2)(c)-(d), DPA 2018 s. 119A | Standard clauses: IDTA and UK Addendum | Use standard clauses the regulator issues under s. 119A, the International Data Transfer Agreement or the UK Addendum to the EU clauses, or clauses the Secretary of State specifies. Check the current versions. |
| Art. 46(2)(a)-(b), (e)-(f), 46(3) | Other safeguards | Other routes are a binding instrument between public bodies, approved binding corporate rules, an approved code or certification with binding commitments from the recipient, or contract clauses authorised by the regulator. |
| Art. 47 | Binding corporate rules | For transfers inside a corporate group, use binding corporate rules approved by the regulator that bind every member, give people enforceable rights and cover the content the article lists. |
| Art. 49(1) | Exceptions for specific situations | Where there is neither approval nor safeguards, rely on a narrow exception only, such as explicit consent after being told the risks, contract necessity, legal claims or vital interests. |
| Art. 49(1), 49(6) | Last-resort exception and records | As a last resort a non-repetitive transfer affecting few people may rest on compelling legitimate interests with safeguards. Document the assessment and safeguards in your Article 30 record and tell the regulator. |
| Art. 49(4), 49A | Public interest and restrictions | The public interest exception needs a public interest recognised in UK law. Regulations can bar transfers of a category of data, and you may not use safeguards or exceptions against such a bar. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 84B(1) | When this processing is allowed | Use personal data for research, archiving or statistics only where it is collection, conversion into non-identifying information, or processing that the purposes cannot be met without. From 5 February 2026. |
| Art. 84B(2), 84C | Safeguards required | Safeguards must not be likely to cause substantial damage or distress, must not support decisions about individuals (except approved medical research), and must include minimisation measures such as pseudonymisation. |
| Ref | Control | What it asks for |
|---|---|---|
| DPA 2018 s. 164A(1)-(2) | Make complaints easy | People may complain to you that you infringed the UK GDPR in connection with their data. Facilitate this with steps such as an electronic complaint form as well as other means. In force from 19 June 2026. |
| DPA 2018 s. 164A(3) | Acknowledge within 30 days | Acknowledge each complaint within 30 days of receiving it. Applies to complaints received on or after 19 June 2026. |
| DPA 2018 s. 164A(4)-(5) | Respond and report the outcome | Without undue delay, take appropriate steps to respond, including enquiries where appropriate and progress updates, and tell the complainant the outcome. Applies to complaints received on or after 19 June 2026. |
| DPA 2018 s. 164B | Complaint statistics | Regulations may require you to tell the regulator how many complaints you received in a period. Watch for any made. |
| Ref | Control | What it asks for |
|---|---|---|
| DPA 2018 s. 137 | Data protection charge | Pay the charge, and give the information, that regulations under s. 137 require of controllers, unless you are exempt. Check the current regulations for who pays and how much. Non-compliance can lead to an enforcement notice. |
| Art. 58(1) | Regulator's investigative powers | Give the regulator the information, audits, access to data and access to premises and equipment it is entitled to. |
| Art. 58(2) | Corrective powers | Expect warnings, reprimands, orders to comply or to erase, bans on processing, suspended transfers and fines, and comply with any order. |
| DPA 2018 s. 142 | Information notices | Provide the information in a written information notice by its deadline unless you appeal. The notice can reach a controller or processor and, under s. 142(9), their UK representative. |
| DPA 2018 s. 146 | Assessment notices | If served, let the regulator enter premises, see documents, equipment and processing, copy material and interview staff, and give the explanations it asks for, within the notice's deadlines. |
| DPA 2018 s. 146(2)(j)-(k), 146A | Reports by an approved person | If the notice requires, nominate a suitable person to report on a specified matter, give them reasonable help, pay their fees and expenses, and give the report to the regulator. From 5 February 2026. |
| DPA 2018 s. 148A | Interview notices | If the regulator suspects an infringement or offence, the controller or processor, staff and managers, past or present, can be required to attend and answer questions, subject to appeal rights. From 5 February 2026. |
| DPA 2018 s. 149 | Enforcement notices | Do or stop what an enforcement notice requires. It can follow failures under Chapter II, Articles 12 to 22D, 25 to 39 and 44A to 49A, the charge rules and, from 19 June 2026, the complaints duty. |
| DPA 2018 ss. 155, 157(4)-(4A) | Penalty notices for failing notices or complaints duty | Ignoring an information, assessment, interview or enforcement notice can bring the higher fine. Failing the s. 164A complaints duty can bring the lower one (from 19 June 2026). |
| DPA 2018 s. 165 | Complaints to the regulator | Expect that anyone can complain to the regulator, which must respond. Article 77 was removed from 19 June 2026, so keep your own complaint handling sound to head this off. |
| Art. 79-80 | Court action and representative actions | Expect individuals to bring court claims against a controller or processor, and qualifying not-for-profit bodies to make complaints for them under s. 164A or 165 of the 2018 Act. |
| Art. 82 | Compensation and liability | Compensate anyone who suffers material or non-material damage from your infringement. A processor is liable only for its own breaches or for acting outside lawful instructions. |
| Art. 83(2) | Factors in setting a fine | Expect fines to reflect the nature, duration, intent, mitigation, previous breaches, cooperation, data involved and how the regulator found out, and keep records of your efforts to comply. |
| Art. 83(4) | Lower fine tier | For breaches of Articles 8, 11, 25 to 39, 42 and 43 the maximum is the greater of GBP 8.7 million or 2% of worldwide annual turnover for an undertaking, and GBP 8.7 million otherwise. |
| Art. 83(5)-(6) | Higher fine tier | For breaches of Articles 5, 6, 7, 9, 12 to 21, 22B, 22C, 44A to 49 or a regulator order the maximum is the greater of GBP 17.5 million or 4% of worldwide annual turnover for an undertaking. |
| Art. 84 | Other penalties | Part 6 of the 2018 Act sets the wider penalty regime for infringements, so read it alongside the fine tiers. |
| Ref | Control | What it asks for |
|---|---|---|
| DPA 2018 s. 144 | False statements to the regulator | It is an offence to make a statement you know is false in a material respect, or recklessly to make one, in response to an information notice. Brief those who answer. |
| DPA 2018 s. 148 | Destroying or falsifying information | It is an offence, after an information or assessment notice, to destroy, conceal, block or falsify material to stop the regulator seeing it, or to cause or permit that. Preserve what a notice covers. |
| DPA 2018 s. 170 | Unlawfully obtaining personal data | It is an offence knowingly or recklessly to obtain, disclose, procure disclosure of or keep personal data without the controller's consent, or to sell or offer it. Defences exist. Tell staff and control access. |
| DPA 2018 s. 171 | Re-identifying de-identified data | It is an offence knowingly or recklessly to re-identify de-identified data without the responsible controller's consent, or to process data you know was re-identified that way. Defences exist, including effectiveness testing. |
| DPA 2018 s. 173 | Interfering with an access request | It is an offence for a controller, or its staff, officers or anyone under its direction, to alter, hide, block, erase or destroy information to stop disclosure that a requester is entitled to. |
| DPA 2018 s. 184 | Enforced subject access | It is an offence to require a job applicant, employee, contractor or customer to hand over a relevant record they obtained by an access request, such as certain conviction, health or official records, with limited defences. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
It can. If you offer goods or services to people in the UK, or monitor their behaviour there, the UK GDPR applies even though you are not established in the UK, and you may need a UK representative. Sending UK personal data to India is a restricted transfer, so check whether regulations approve it or use safeguards such as the IDTA or the UK Addendum.
It amends, but does not replace, the UK GDPR and the 2018 Act. Provisions came into force in stages: 20 August 2025, most data protection changes on 5 February 2026, the complaints duty on 19 June 2026, and the Information Commission replaced the Information Commissioner on 30 September 2026.
There are two tiers. Breaches of duties such as design, processors, records, security, breach reporting, impact assessments and DPOs can reach GBP 8.7 million or 2% of worldwide annual turnover. Breaches of the principles, consent, rights, automated decision rules and transfer rules can reach GBP 17.5 million or 4%, whichever is higher.
No. Section 9 was removed from the Act at the end of 2020. Article 8 of the UK GDPR now states the age of 13 for online services offered directly to children, and regulations may change it to an age between 13 and 16.
No. It is a plain-English summary of the main duties, in our own words, with some provisions split where they carry separate duties. Provisions about the regulator's own structure and the powers of the Secretary of State to make regulations are mostly left out. The legislation, as amended, is the authority.