The Data Protection Act (2018)
The Data Protection Act (DPA) 2018 brought into UK law the EU’s General Data Protection Regulation. It governs how personal information is used by businesses, organisations and government departments. The Act imposes rules on how data should be handled. These rules are called data protection principles and include guidance on how data can be used, how long it can be kept for, how it should be stored and how it can be shared.
The main points:
Personal information can include an individual’s address, phone number or other personal identifiers.
The DPA 2018 has changed the law relating to processing of data so that data can only be processed with the data subject’s consent or another specified basis (as set out in the Act). This means that organisations can no longer sell on individuals data for marketing purposes without the consent of the individual. Individuals must opt in to be contacted by organisations other than the one who they have provided their data to.
Public bodies may be able to share data about individuals if there is a legal obligation or if they are performing a specific task in the public interest. Alternatively they could share information with another organisation with the data subject’s consent.