EdLaw
Overview and key terms
The Act's own overview, the general protection duty, and the terms that everything else builds on (personal data, processing, controller, processor, data subject).
Section 1 — Overview
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
4 Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes ....
5 Part 4 makes provision about the processing of personal data by the intelligence services (and certain processing carried out by competent authorities jointly with the intelligence services).
8 Part 7 makes supplementary provision, including provision about the application of this Act to the Crown and to Parliament.
Section 2 — Protection of personal data
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
1 The UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—
- a requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis,
- b conferring rights on the data subject to obtain information about the processing of personal data and to require inaccurate personal data to be rectified, and
- c conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions.
Section 3 — Terms relating to the processing of personal data
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
2 “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
3 “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to—
- a an identifier such as a name, an identification number, location data or an online identifier, or
- b one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
4 “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as—
- a collection, recording, organisation, structuring or storage,
- b adaptation or alteration,
- c retrieval, consultation or use,
- d disclosure by transmission, dissemination or otherwise making available,
- e alignment or combination, or
- f restriction, erasure or destruction, (subject to subsection (14)(c) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).
5 “Data subject” means the identified or identifiable living individual to whom personal data relates.
6 “Controller” and “processor”, in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies, have the same meaning as in that ... Part (see sections 5, 6, 32 and 83 and see also subsection (14)(d)).
7 “Filing system” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis.
- a the UK GDPR,
- b . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- c this Act, and
- d regulations made under this Act or the UK GDPR, ...
- e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10 “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
10A “The EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law.
12 “The Law Enforcement Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.
13 “The Data Protection Convention” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28 January 1981, as amended up to the day on which this Act is passed.
- a references to the UK GDPR are to the UK GDPR read with Part 2;
- b . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- c references to personal data, and the processing of personal data, are to personal data and processing to which ... Part 2, Part 3 or Part 4 applies;
- d references to a controller or processor are to a controller or processor in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies.
Sources
- legislation.gov.uk — Data Protection Act 2018, consolidated text
- ICO — Data Protection Act 2018 guidance
Meta
All section text above is reproduced verbatim from the consolidated Data Protection Act 2018 on legislation.gov.uk, extracted mechanically from the official XML. Repealed or omitted text appears as "..." exactly as published. Amendment history is available via each section link. Each provision carries its official identifier as a trailing attribute anchor (e.g. {#section-9-1}), the same id legislation.gov.uk uses.