For ordinary controller and processor activity, start with the UK GDPR and then check the Data Protection Act 2018 for UK conditions, exemptions, powers, procedure, remedies, and offences.
For competent-authority law-enforcement processing or intelligence-services processing, use the separate regimes in Parts 3 and 4 of the 2018 Act.
Structured answer sets in this page tree.
Cited legal and guidance references.
The UK GDPR and Data Protection Act 2018 are complementary, not competing laws. The UK GDPR supplies the main rules for general processing: principles, lawful bases, transparency, rights, controller and processor duties, security, breaches, transfers, and administrative fines. The 2018 Act supplements those rules with UK-specific conditions and exemptions, regulates enforcement and remedies, and creates separate regimes for law-enforcement processing and intelligence-services processing. Later legislation, including the Data (Use and Access) Act 2025, has amended both instruments, so use their current consolidated text. A sound decision identifies the applicable UK GDPR article and the exact DPA 2018 provision that changes or completes the answer.
Compare their scope, roles, conditions, exemptions, evidence, enforcement, and decision sequence.
The main rules for general processing by controllers and processors.
The domestic Act that supplements general processing and creates separate law-enforcement and intelligence-services regimes.
| Dimension | UK GDPR | Data Protection Act 2018 | Operational implication |
|---|---|---|---|
| Scope | Governs general processing within its material and territorial scope, subject to the domestic provisions that supplement or restrict it. | Part 2 supplements general processing; Parts 3 and 4 separately govern law-enforcement and intelligence-services processing. | Classify the processing regime before choosing the rule. |
| Baseline rules | Sets principles, lawful bases, transparency, individual rights, accountability, processor duties, security, breach, transfer, and fine rules for general processing. | Defines domestic terms, conditions, safeguards, exemptions, regulatory procedure, remedies, and offences that complete the UK framework. | For general processing, cite both instruments when the answer depends on a domestic condition or exemption. |
| Special-category and criminal-offence data | Articles 9 and 10 set the general restrictions and identify when domestic law must authorise or condition processing. | Section 10 and Schedule 1 provide detailed UK conditions and safeguards, including an appropriate policy document for specified conditions. | Record both layers; a lawful basis under Article 6 does not by itself authorise special-category or criminal-offence processing. |
| Exemptions | Rights and duties apply unless a valid statutory restriction or exemption affects the specific provision. | Schedules 2-4 provide defined exemptions for specified purposes, data, and circumstances. | Document the exact exemption, its conditions, the affected UK GDPR provision, and the decision for the particular facts. |
| Who acts | Controllers and processors own most operational duties; data subjects, representatives, DPOs, recipients, and the Commissioner also have defined roles. | The applicable Part may assign duties to a controller, , intelligence service, the Commissioner, a tribunal, or a court. | Name the actor and processing regime in each record instead of using 'the organisation' for every duty. |
| Enforcement and remedies | Sets supervisory powers, data-subject remedies, compensation, and the administrative-fine framework at regulation level. | Part 5 establishes the Commissioner; Part 6 contains notices, appeals, complaints, court remedies, compensation provisions, and offences. | Check the current Act for the procedure and remedy attached to a UK GDPR breach. |
| Decision rule | Start here for the baseline rule governing general processing. | Then add the exact Part 2 condition or exemption, or move to Part 3 or Part 4 if that separate regime applies. | Do not choose one instrument and ignore the other; identify the regime and read the relevant provisions together. |
Governs general processing within its material and territorial scope, subject to the domestic provisions that supplement or restrict it.
Part 2 supplements general processing; Parts 3 and 4 separately govern law-enforcement and intelligence-services processing.
Classify the processing regime before choosing the rule.
Sets principles, lawful bases, transparency, individual rights, accountability, processor duties, security, breach, transfer, and fine rules for general processing.
Defines domestic terms, conditions, safeguards, exemptions, regulatory procedure, remedies, and offences that complete the UK framework.
For general processing, cite both instruments when the answer depends on a domestic condition or exemption.
Articles 9 and 10 set the general restrictions and identify when domestic law must authorise or condition processing.
Section 10 and Schedule 1 provide detailed UK conditions and safeguards, including an appropriate policy document for specified conditions.
Record both layers; a lawful basis under Article 6 does not by itself authorise special-category or criminal-offence processing.
Rights and duties apply unless a valid statutory restriction or exemption affects the specific provision.
Schedules 2-4 provide defined exemptions for specified purposes, data, and circumstances.
Document the exact exemption, its conditions, the affected UK GDPR provision, and the decision for the particular facts.
Controllers and processors own most operational duties; data subjects, representatives, DPOs, recipients, and the Commissioner also have defined roles.
The applicable Part may assign duties to a controller, , intelligence service, the Commissioner, a tribunal, or a court.
Name the actor and processing regime in each record instead of using 'the organisation' for every duty.
Sets supervisory powers, data-subject remedies, compensation, and the administrative-fine framework at regulation level.
Part 5 establishes the Commissioner; Part 6 contains notices, appeals, complaints, court remedies, compensation provisions, and offences.
Check the current Act for the procedure and remedy attached to a UK GDPR breach.
Then add the exact Part 2 condition or exemption, or move to Part 3 or Part 4 if that separate regime applies.
Do not choose one instrument and ignore the other; identify the regime and read the relevant provisions together.
Most commercial, charitable, public-sector, and employment processing falls within the general-processing regime: the UK GDPR together with Part 2 of the DPA 2018. The organisation should identify its controller or processor role, purpose, lawful basis, transparency duties, rights handling, retention, security, processor terms, and transfers under the UK GDPR, then check whether the 2018 Act supplies an additional condition, safeguard, or exemption.
Part 3 of the DPA 2018 applies to processing by a for a law-enforcement purpose. Part 4 applies to intelligence-services processing. A public body does not enter Part 3 merely because its work has a public-safety connection; both the statutory competent-authority status and the law-enforcement purpose matter.
Article 9 UK GDPR prohibits special-category processing unless an Article 9(2) condition applies. Where that condition requires authorisation by domestic law, section 10 and Schedule 1 of the DPA 2018 provide detailed UK conditions and, for some conditions, require an appropriate policy document. Criminal-offence data also requires Article 10 authority and the applicable DPA 2018 route.
Schedules 2 to 4 contain exemptions and restrictions for defined purposes and circumstances. They do not erase the UK GDPR wholesale. Record the provision relied on, the facts that satisfy each condition, which right or duty is affected, why applying it is necessary where the provision requires that test, and what can still be provided to the person.
Link each processing decision to its UK GDPR article, any DPA 2018 condition or exemption, the responsible owner, and the evidence that satisfies the rule.
Turn the applicable rules into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.