Data Protection Act 2018

The Data Protection Act 2018 received Royal Assent on 23 May 2018. The Act, which replaces the 1998 Act, provides a legal framework for data protection in the UK. It is supplemented by the General Data Protection Regulation (GDPR), the legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU). Schedule 3 Section 15 outlines exemptions from the GDPR relating to health, social work, education and child abuse. When the UK leaves the EU, the GDPR will be incorporated into the UK’s domestic law under the powers in the European Union (Withdrawal) Bill, currently before Parliament.