Data Protection Act 2018 — practical summary
How the DPA 2018 sits alongside the UK GDPR, including exemptions, law-enforcement processing, enforcement and the new complaint provisions inserted by the DUAA.
How it fits with UK GDPR
The Data Protection Act 2018 supplements the UK GDPR and contains important UK-specific rules, exemptions and separate regimes. You often need to read the two together rather than treating the DPA as a replacement for UK GDPR.
Why it matters for SARs
Many of the specific exemptions that can affect a SAR sit in the DPA 2018 schedules. Examples include legal professional privilege, certain crime and taxation purposes, confidential references, management information, negotiations and information about other people.
Different processing regimes
The Act also contains separate rules for competent authorities processing personal data for law-enforcement purposes and for intelligence services. The precise rights and restrictions can differ from an ordinary UK GDPR SAR.
Complaints after the DUAA
The DUAA inserted new complaint-handling provisions into the DPA 2018. For complaints received by controllers on or after 19 June 2026, the statutory controller complaint duties apply.
Official sources
- Data Protection Act 2018
- ICO – SAR exemptions
- ICO – Data-protection complaint guidance
- Data (Use and Access) Act 2025
Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.