The Data Protection Act and GDPR

The Data Protection Act 2018 (DPA) is the UK's main law governing how personal data is collected, stored, and used. It incorporates the principles of the General Data Protection Regulation (GDPR), which is an EU regulation that the UK adopted.

---

What is Personal Data?

Personal data is any information that can identify a living individual, directly or indirectly. Examples include:

• Name, address, date of birth
• Email address, phone number
• Medical records, financial information
• IP addresses, location data
• Photographs, biometric data (fingerprints, facial recognition)

Sensitive personal data (called "special category data" under GDPR) requires extra protection and includes:

• Racial or ethnic origin
• Political opinions
• Religious beliefs
• Trade union membership
• Health data
• Sexual orientation
• Biometric data used for identification
• Genetic data

---

Key Terms